Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write
Published Jul 6, 2026
9.8
CRITICALCVSS 3.1
EPSS 0.69%
Description
Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Affected products
-
Affected
- ≥ 1.3.3, < 2.0.8
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Apache Software Foundation | Apache IoTDB | unaffected | Affected
|
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (3)
- http://www.openwall.com/lists/oss-security/2026/07/06/12 Mailing ListThird Party Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41854 Advisory
- https://lists.apache.org/thread/38298f803gb5j9nlhf0l9zkf34o90h3m vendor-advisoryMailing ListVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/06/12 | Mailing ListThird Party Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41854 | Advisory | |
| https://lists.apache.org/thread/38298f803gb5j9nlhf0l9zkf34o90h3m | vendor-advisoryMailing ListVendor Advisory |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
Red Hat
No data
GitHub
No data