CRITICAL 9.1 Maven
Apache IoTDB has a Path Traversal vulnerability
GHSA-h548-jhj8-q85h · CVE-2025-64152
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.
This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7.
Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-64152
- WEB https://github.com/apache/iotdb/pull/16596
- WEB https://github.com/apache/iotdb/commit/3fdfe2e6ca99e3b65b3455c5aeb45cdb2302efab
- WEB https://github.com/apache/iotdb/commit/7770bacf3d8a04bd4d4dea4d82694c137f48746e
- PACKAGE https://github.com/apache/iotdb
- WEB https://github.com/apache/iotdb/releases/tag/v1.3.6
- WEB https://github.com/apache/iotdb/releases/tag/v2.0.7
- WEB https://lists.apache.org/thread/sjms84rlt4g78fwmjcowxmtjp1q8b9q4
- WEB http://www.openwall.com/lists/oss-security/2026/03/09/3
Ready to move
Start Securing
Free, no credit card | First findings in minutes