{"id":"CVE-2025-64152","kind":"vulnerability","aliases":["CVE-2025-64152","GHSA-h548-jhj8-q85h"],"related":[],"title":"Apache IoTDB has a Path Traversal vulnerability","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.\n\nThis issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7.\n\nUsers are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.","summary":"Apache IoTDB server mishandles file paths, so a crafted request can reach files outside the intended directory. The sources do not say exactly which files can be read or written, but the CVSS score of 9.1 indicates severe impact.","severity":"critical","cvss":9.1,"epss":0.00537,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.iotdb:iotdb-server","fixed":["1.3.6"],"affected":">= 1.0.0, < 1.3.6","ecosystem":"maven"},{"name":"org.apache.iotdb:iotdb-server","fixed":["2.0.7"],"affected":">= 2.0.0, < 2.0.7","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["apache-iotdb","cwe-22","java","package","self-hosted","time-series-database"],"not_affected_if":["version-1.3.6-or-later","version-2.0.7-or-later"],"how_to_check":"- Check the installed `iotdb-server` Maven version in your build file or lockfile; affected versions are 1.0.0 up to but not including 1.3.6, and 2.0.0 up to but not including 2.0.7.\n- Confirm which IoTDB server version is running in each deployment.","fix":"- Upgrade `iotdb-server` 1.x to `1.3.6`\n- Upgrade `iotdb-server` 2.x to `2.0.7`","status":"open","published_at":"2026-06-26T13:16:33+00:00","first_seen_at":"2026-11-03T22:02:22+00:00","triaged_at":"2026-11-03T22:03:43+00:00","updated_at":"2026-11-03T22:07:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T22:03:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `iotdb-server` 1.x to `1.3.6`\n- Upgrade `iotdb-server` 2.x to `2.0.7`","reach":"unknown","title":"Apache IoTDB: path traversal lets remote users read or write server files","impact":"high","summary":"Apache IoTDB server mishandles file paths, so a crafted request can reach files outside the intended directory. The sources do not say exactly which files can be read or written, but the CVSS score of 9.1 indicates severe impact.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-iotdb","java","time-series-database","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"remote attacker reads or writes arbitrary server files","analyst_note":"Sources do not state whether authentication or a non-default setting is required to trigger the traversal; check the GHSA-h548-jhj8-q85h advisory details.","how_to_check":"- Check the installed `iotdb-server` Maven version in your build file or lockfile; affected versions are 1.0.0 up to but not including 1.3.6, and 2.0.0 up to but not including 2.0.7.\n- Confirm which IoTDB server version is running in each deployment.","plain_action":"","needs_analyst":true,"not_affected_if":["version-1.3.6-or-later","version-2.0.7-or-later"],"who_is_affected":"Teams running the Apache IoTDB server, the time-series database, in versions 1.0.0 through 1.3.5 or 2.0.0 through 2.0.6. The sources do not say which configuration or endpoints make it reachable, so exposure depends on whether the server accepts requests from untrusted networks. Deployments already on 1.3.6 or 2.0.7 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000768,"input_tokens":4321,"output_tokens":671,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2025':9A,17A '-22':31B '-64152':10A,18A '1.0.0':101C '1.3.6':103C,115C '2.0.0':105C '2.0.7':107C,117C '9.1':76B 'affect':97C 'apach':1A,28B,41B,93C,98C 'apache-iotdb':27B 'craft':49B 'cve':8A,16A 'cvss':73B 'cwe':30B 'databas':40B 'directori':57B,88C 'exact':63B 'file':45B,53B,65B 'fix':119C 'ghsa':12A 'ghsa-h548-jhj8-q85h':11A 'h548':13A 'host':36B 'impact':79B 'improp':80C 'indic':77B 'intend':56B 'iotdb':2A,21A,25A,29B,42B,94C,99C 'iotdb-server':20A,24A 'issu':96C,121C 'java':32B 'jhj8':14A 'limit':81C 'mishandl':44B 'org.apache.iotdb':19A,23A 'outsid':54B 'packag':33B 'path':5A,46B,89C 'pathnam':84C 'q85h':15A 'reach':52B 'read':68B 'recommend':110C 'request':50B 'restrict':87C 'say':62B 'score':74B 'self':35B 'self-host':34B 'seri':39B 'server':22A,26A,43B 'sever':78B 'sourc':59B 'time':38B 'time-series-databas':37B 'travers':6A,90C 'upgrad':112C 'user':108C 'version':114C 'vulner':7A,91C 'written':70B","nicknames":[],"mitigations":[],"who_affected":"Teams running the Apache IoTDB server, the time-series database, in versions 1.0.0 through 1.3.5 or 2.0.0 through 2.0.6. The sources do not say which configuration or endpoints make it reachable, so exposure depends on whether the server accepts requests from untrusted networks. Deployments already on 1.3.6 or 2.0.7 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["orgapacheiotdbiotdbserver"],"ptokens":["apache","iotdb","org","server"],"labels":["apacheiotdb","critical","cwe22","java","maven","package","selfhosted","timeseriesdatabase"],"campaign_type":null,"first_public_at":"2026-06-26T13:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-h548-jhj8-q85h","url":"https://github.com/advisories/GHSA-h548-jhj8-q85h","severity":"critical","published_at":"2026-06-26T15:32:13+00:00","modified_at":"2026-11-03T22:00:04+00:00","first_seen_at":"2026-11-03T22:02:22+00:00","fetched_at":"2026-11-03T22:02:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-64152","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64152","severity":null,"published_at":"2026-06-26T13:16:33+00:00","modified_at":"2026-09-29T19:10:00+00:00","first_seen_at":"2026-11-03T22:07:19+00:00","fetched_at":"2026-11-03T22:07:19+00:00","note":null}],"documents":[{"id":61021,"url":"https://github.com/apache/iotdb/pull/16596","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61022,"url":"https://github.com/apache/iotdb/commit/3fdfe2e6ca99e3b65b3455c5aeb45cdb2302efab","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61023,"url":"https://github.com/apache/iotdb/commit/7770bacf3d8a04bd4d4dea4d82694c137f48746e","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61007,"url":"https://github.com/apache/iotdb/releases/tag/v1.3.6","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":61025,"url":"https://github.com/apache/iotdb/releases/tag/v2.0.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}