---
id: "CVE-2025-64152"
kind: "vulnerability"
aliases: ["CVE-2025-64152", "GHSA-h548-jhj8-q85h"]
title: "Apache IoTDB has a Path Traversal vulnerability"
severity: "critical"
cvss: 9.1
epss: 0.00537
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.iotdb:iotdb-server", "fixed": ["1.3.6"], "affected": ">= 1.0.0, < 1.3.6", "ecosystem": "maven"}, {"name": "org.apache.iotdb:iotdb-server", "fixed": ["2.0.7"], "affected": ">= 2.0.0, < 2.0.7", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["apache-iotdb", "cwe-22", "java", "package", "self-hosted", "time-series-database"]
not_affected_if: ["version-1.3.6-or-later", "version-2.0.7-or-later"]
published_at: "2026-06-26T13:16:33+00:00"
first_seen_at: "2026-11-03T22:02:22+00:00"
updated_at: "2026-11-03T22:07:19+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h548-jhj8-q85h", "first_seen_at": "2026-11-03T22:02:22+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64152", "first_seen_at": "2026-11-03T22:07:19+00:00"}]
---

# Apache IoTDB has a Path Traversal vulnerability

Apache IoTDB server mishandles file paths, so a crafted request can reach files outside the intended directory. The sources do not say exactly which files can be read or written, but the CVSS score of 9.1 indicates severe impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.iotdb:iotdb-server affected >= 1.0.0, < 1.3.6 fixed 1.3.6
- maven:org.apache.iotdb:iotdb-server affected >= 2.0.0, < 2.0.7 fixed 2.0.7

## How to check

- Check the installed `iotdb-server` Maven version in your build file or lockfile; affected versions are 1.0.0 up to but not including 1.3.6, and 2.0.0 up to but not including 2.0.7.
- Confirm which IoTDB server version is running in each deployment.

## Fix

- Upgrade `iotdb-server` 1.x to `1.3.6`
- Upgrade `iotdb-server` 2.x to `2.0.7`

## Timeline

- 2026-11-03T22:02:22+00:00 ghsa https://github.com/advisories/GHSA-h548-jhj8-q85h
- 2026-11-03T22:07:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-64152

## Documents

- [fix] Patch: github.com https://github.com/apache/iotdb/pull/16596
- [fix] Patch: github.com https://github.com/apache/iotdb/commit/3fdfe2e6ca99e3b65b3455c5aeb45cdb2302efab
- [fix] Patch: github.com https://github.com/apache/iotdb/commit/7770bacf3d8a04bd4d4dea4d82694c137f48746e
- [fix] Release: github.com https://github.com/apache/iotdb/releases/tag/v1.3.6
- [fix] Release: github.com https://github.com/apache/iotdb/releases/tag/v2.0.7

## From the sources

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_