CVE Intelligence
Analysis AI-assisted

CVE-2025-64152: Apache IoTDB Path Traversal Vulnerability

CVE-2025-64152 is a path traversal weakness (CWE-22) in Apache IoTDB that allows a pathname to escape a restricted directory. The record lists affected ranges from 1.0.0 before 1.3.6 and from 2.0.0 before 2.0.7, and recommends upgrading to 1.3.6 or 2.0.7. The CNA scored it 9.1 (Critical) under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-64152 is a path traversal issue (CWE-22) in Apache IoTDB, described as an improper limitation of a pathname to a restricted directory. The record was published by the Apache Software Foundation as CNA (security@apache.org) and is listed in NVD with a Critical severity rating.

Impact

  • The CVSS 3.1 vector reported is AV:N, AC:L, PR:N, UI:N, with high confidentiality and integrity impact and no availability impact.
  • Under this vector, the flaw is reachable over the network, needs no privileges and no user interaction.
  • Based on the CWE class, an attacker who reaches the vulnerable function could potentially access or alter files outside the intended directory. The exact data exposed depends on deployment details that the record does not describe.

Affected products and versions

  • Apache IoTDB from 1.0.0 before 1.3.6.
  • Apache IoTDB from 2.0.0 before 2.0.7.

The structured affected and fixes fields in the record are empty, so the version ranges above come from the description text only.

Exploitation status

The CISA KEV catalog does not list this CVE, and no exploitation in the wild is recorded in the record. No confirmed exploitation appears in the sources consulted. The EPSS score is not available.

Remediation and mitigation

  • The record recommends upgrading to version 1.3.6 for the 1.x line and to version 2.0.7 for the 2.x line.
  • Inventory all Apache IoTDB instances and identify those in the affected ranges.
  • If an upgrade cannot be applied immediately, reduce network exposure of the service, restrict access to trusted hosts, and run the service with the least file system privileges needed. These steps are general defensive practice and are not stated in the record as official mitigations.

Detection guidance

  • Review service and access logs for requests that reference unusual or out-of-scope file locations.
  • Monitor file system access by the IoTDB service account for reads or writes outside its expected data directories.
  • Correlate alerts with asset inventory to confirm which instances are running affected versions.

Limitations of the available information

  • The structured affected and fixes fields are empty, so version data is taken from the description only.
  • The record does not describe the vulnerable component, preconditions, or the full impact on confidentiality and integrity.
  • The source status is marked Deferred, and no EPSS or SSVC data is available.
  • The two referenced mailing list threads were not analysed in detail for this summary.

Frequently asked questions

What is CVE-2025-64152?

It is a path traversal weakness (CWE-22) in Apache IoTDB where a pathname is not properly limited to a restricted directory.

Which versions are affected?

The record states the issue affects Apache IoTDB from 1.0.0 before 1.3.6 and from 2.0.0 before 2.0.7.

Which versions should be used to fix it?

The record recommends upgrading to version 1.3.6 and version 2.0.7.

Is this CVE known to be exploited?

It is not listed in the CISA KEV catalog and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.