PUBLISHED
2026-07-06 09:16
MODIFIED
2026-07-06 09:16
EPSS (Prob. Exploit)
0.69%
Top 47.7%
> DESCRIPTION
Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-284: Improper Access Control - The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. | CWE-434: Unrestricted Upload of File with Dangerous Type - The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write
> HISTORIQUE DES MODIFICATIONS
Première apparition
06/07/2026 09:16
Source: NVD
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-284: Improper Access Control - The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. | CWE-434: Unrestricted Upload of File with Dangerous Type - ...
Total des modifications: 1
Dernière mise à jour: 3 months ago