Live › vulnerability › CVE-2025-64152
Apache IoTDB server mishandles file paths, so a crafted request can reach files outside the intended directory. The sources do not say exactly which files can be read or written, but the CVSS score of 9.1 indicates severe impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 22:02 UTC, 0h before NVD. All times on this page are UTC.
Teams running the Apache IoTDB server, the time-series database, in versions 1.0.0 through 1.3.5 or 2.0.0 through 2.0.6. The sources do not say which configuration or endpoints make it reachable, so exposure depends on whether the server accepts requests from untrusted networks. Deployments already on 1.3.6 or 2.0.7 or later are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.iotdb:iotdb-server | maven | >= 1.0.0, < 1.3.6 | 1.3.6 |
| org.apache.iotdb:iotdb-server | maven | >= 2.0.0, < 2.0.7 | 2.0.7 |
iotdb-server Maven version in your build file or lockfile; affected versions are 1.0.0 up to but not including 1.3.6, and 2.0.0 up to but not including 2.0.7.iotdb-server 1.x to 1.3.6iotdb-server 2.x to 2.0.7Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7.
Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2025-64152")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.