Apache IoTDB contains a path traversal flaw caused by inadequate restriction of pathname limits. An attacker can provide crafted input that resolves to directories outside the intended root, allowing the reading of arbitrary files, and if the exposed interfaces permit, the potential for writing to any location the process can access (inferred). This weakness is classified as CWE‑22 and may lead to disclosure of sensitive configuration or operating system files, potentially affecting confidentiality of the system.

Apache IoTDB maintained by the Apache Software Foundation. Versions 2.0.0 through 2.0.5 and 1.0.0 through 1.3.5 are impacted. Any deployment of these versions is vulnerable.

The CVSS score of 9.1 indicates a critical severity, while EPSS data is not available, suggesting a low probability of exploitation at this time. Path traversal vulnerabilities may pose a high risk, especially when exposed through network-accessible interfaces (inferred). The flaw is not listed in the CISA KEV catalog, so there is no current evidence of exploitation in the wild. Based on the description, it is inferred that the flaw could be triggered by users capable of interacting with IoTDB’s file handling mechanisms, whether authenticated or unauthenticated.