Executive brief
Apache IoTDB, a database designed for managing large amounts of time-series data, contains a security flaw that allows an attacker to write files to unauthorized locations on the server. By exploiting an unsafe programming interface, a malicious actor could place files anywhere the database process has permission to write. This could lead to a complete system takeover, data corruption, or the disruption of database operations.
Technical details
A path traversal vulnerability (CWE-22) exists in Apache IoTDB due to improper limitation of pathnames within an unsafe API. An attacker can exploit this by providing manipulated file paths that bypass intended directory restrictions. If successful, the attacker can write arbitrary files to any location on the filesystem where the IoTDB process has write permissions. This could potentially lead to remote code execution if the attacker can overwrite executable files or configuration settings. The issue is fixed in version 2.0.10.
Affected products
- Apache IoTDB 1.0.0 to 2.0.9
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory