Executive brief
Apache IoTDB, a database designed for managing Internet of Things (IoT) data, contains a security flaw that could allow an attacker to access files outside of the intended directory. This type of vulnerability, known as path traversal, could lead to the exposure of sensitive system information or configuration files. Organizations using affected versions should update to the latest releases to prevent unauthorized file access.
Technical details
A path traversal vulnerability (CWE-22) exists in Apache IoTDB due to improper limitation of pathnames to restricted directories. An attacker could potentially exploit this by providing specially crafted input containing directory traversal sequences (e.g., '../') to access sensitive files on the host system that should be inaccessible to the application. The vulnerability affects versions 1.0.0 through 1.3.5 and 2.0.0 through 2.0.5. Users are advised to upgrade to versions 1.3.6 or 2.0.6 to remediate the issue.
Affected products
- Apache IoTDB 1.0.0 to 1.3.5, 2.0.0 to 2.0.5
Timeline
- 2026-06-26: disclosed
- 2026-06-26: advisory