Apache IoTDB's DataNode by accepting an uploaded JAR file. The name supplied for the JAR is concatenated into a file path without proper validation, allowing an attacker to embed path-traversal sequences. This flaw lets the attacker write arbitrary files with the permissions of the IoTDB process, potentially compromising the system or installing malicious binaries. The weakness is a combination of improper access control and insecure file upload handling, represented by CWE-284 and CWE-434.

The vulnerability affects Apache IoTDB DataNode components from version 1.3.3 up to, but not including, 2.0.8. The product is maintained by the Apache Software Foundation.

The CVSS score of 9.8 signifies a critical severity. The EPSS score indicates a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. The likely attack vector is an attacker who can reach description, it is inferred that the RPC interface accepts JAR uploads without requiring authentication or additional privileges. Exploitation therefore depends on network exposure of the RPC port and the ability to connect to it from an untrusted network.