CVE Intelligence
Analysis AI-assisted

CVE-2025-55017: Apache IoTDB Path Traversal Vulnerability

CVE-2025-55017 is a path traversal flaw (CWE-22) in Apache IoTDB, affecting 2.0.0 before 2.0.6 and 1.0.0 before 1.3.6. The CNA rates it critical with a CVSS 3.1 base score of 9.1, and the vector indicates network access without privileges or user interaction. Upgrading to 1.3.6 or 2.0.6 is the recommended remediation, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-55017 is classified as CWE-22, improper limitation of a pathname to a restricted directory. The CNA describes it as affecting Apache IoTDB in two release lines. Details here are drawn from the record and the Apache mailing list thread.

Impact

  • The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N indicates a network attack vector, low complexity, no privileges required and no user interaction, with high confidentiality and integrity impact and no availability impact.
  • Path traversal flaws generally allow access to files outside the intended directories. The record does not detail which data could be exposed.

Affected products and versions

  • Apache IoTDB from 2.0.0 before 2.0.6.
  • Apache IoTDB from 1.0.0 before 1.3.6.
  • The structured affected list in the record is empty, so these ranges come from the description text.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade Apache IoTDB to 1.3.6 or 2.0.6, depending on the release line in use.
  • Limit network exposure of IoTDB instances to trusted hosts until the upgrade is applied.
  • Review the NVD entry and vendor communications for updated guidance.

Detection guidance

  • Review access logs for requests referencing paths outside the expected IoTDB data locations.
  • Monitor file system activity from the IoTDB service account for unexpected reads.

Limitations of the available information

  • The record contains no structured fix entries, no EPSS value and no SSVC value. The fixed versions are taken from the description.
  • Whether a given deployment is exploitable depends on its configuration, which the record does not describe.
  • Public proof-of-concept availability is unknown from the sources consulted.

Frequently asked questions

Which Apache IoTDB versions are affected by CVE-2025-55017?

According to the description, versions from 2.0.0 before 2.0.6 and from 1.0.0 before 1.3.6 are affected.

Is CVE-2025-55017 known to be exploited?

The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.