Executive brief
Apache IoTDB, a high-performance database designed for Internet of Things (IoT) data, contains a security flaw that could allow an attacker to access files outside of the intended directory. This could lead to the exposure of sensitive system information or configuration files, potentially compromising the integrity of the database server. Organizations using affected versions should upgrade to the latest releases to prevent unauthorized file access.
Technical details
A path traversal vulnerability (CWE-22) exists in Apache IoTDB due to improper limitation of pathnames to a restricted directory. An attacker could potentially exploit this by providing specially crafted input containing directory traversal sequences (e.g., '../') to access sensitive files on the host file system. The vulnerability affects versions 1.0.0 through 1.3.5 and 2.0.0 through 2.0.6. Users are advised to upgrade to versions 1.3.6 or 2.0.7, which implement proper path validation and sanitization.
Affected products
- Apache IoTDB 1.0.0 to 1.3.5, 2.0.0 to 2.0.6
Timeline
- 2026-06-26: disclosed
- 2026-06-26: advisory