Executive brief
Apache Ignite is a distributed database and computing platform used for high-performance data processing. A security flaw in its management interface allows an authorized user to bypass folder restrictions and read sensitive files from the underlying server. This could lead to the exposure of configuration files, credentials, or other private system data, potentially compromising the entire server environment.
Technical details
A relative path traversal vulnerability exists in the Apache Ignite REST API within the 'cmd=log' command handler. The root cause is insufficient validation of the log path parameter; the application previously only checked if a path started with the Ignite home directory, which could be bypassed using '../' sequences. An authenticated attacker can exploit this by sending a specially crafted REST request to access files outside of the intended directory. This issue affects versions 2.0.0 through 2.17.0 and is resolved in version 2.18.0.
Affected products
- Apache Ignite 2.0.0 through 2.17.0
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
- 2026-05-28: patched: Fixed in version 2.18.0