---
id: "CVE-2025-55017"
kind: "vulnerability"
aliases: ["CVE-2025-55017", "GHSA-xrvj-h9w2-3q69"]
title: "Apache IoTDB has a Path Traversal vulnerability"
severity: "critical"
cvss: 9.1
epss: 0.00537
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.iotdb:iotdb-server", "fixed": ["2.0.6"], "affected": ">= 2.0.0, < 2.0.6", "ecosystem": "maven"}, {"name": "org.apache.iotdb:iotdb-server", "fixed": ["1.3.6"], "affected": ">= 1.0.0, < 1.3.6", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["apache-iotdb", "cwe-22", "iotdb-server", "java", "maven", "package", "time-series-database"]
not_affected_if: ["versions-outside-affected-ranges"]
published_at: "2026-06-26T13:16:33+00:00"
first_seen_at: "2026-11-03T21:57:17+00:00"
updated_at: "2026-11-03T22:07:19+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-xrvj-h9w2-3q69", "first_seen_at": "2026-11-03T21:57:17+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55017", "first_seen_at": "2026-11-03T22:07:19+00:00"}]
---

# Apache IoTDB has a Path Traversal vulnerability

Apache IoTDB server mishandles file paths, so a crafted request can read or write files outside the intended directory. The advisory rates it critical (CVSS 9.1), and the sources do not say what a request needs to reach the flaw.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.iotdb:iotdb-server affected >= 2.0.0, < 2.0.6 fixed 2.0.6
- maven:org.apache.iotdb:iotdb-server affected >= 1.0.0, < 1.3.6 fixed 1.3.6

## How to check

- Check the installed `iotdb-server` version in your Maven dependencies or deployment, and see whether it falls in `>= 2.0.0, < 2.0.6` or `>= 1.0.0, < 1.3.6`.

## Fix

- Upgrade to `2.0.6` on the 2.0 line.
- Upgrade to `1.3.6` on the 1.x line.

## Timeline

- 2026-11-03T21:57:17+00:00 ghsa https://github.com/advisories/GHSA-xrvj-h9w2-3q69
- 2026-11-03T22:07:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-55017

## Documents

- [fix] Patch: github.com https://github.com/apache/iotdb/pull/16097
- [fix] Patch: github.com https://github.com/apache/iotdb/pull/16098
- [fix] Patch: github.com https://github.com/apache/iotdb/commit/6c27518610776be16dc998403918e978968a7325
- [fix] Patch: github.com https://github.com/apache/iotdb/commit/9a15b5d13f5b19f13ddb46b799567fbabcb0e541
- [fix] Release: github.com https://github.com/apache/iotdb/releases/tag/v1.3.6
- [fix] Release: github.com https://github.com/apache/iotdb/releases/tag/v2.0.6

## From the sources

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6.

Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_