Apache IoTDB suffers from a missing authentication requirement on the legacy pipe sendFile RPC function, which allows an attacker to invoke the operation without credentials. This flaw can be leveraged to traverse arbitrary file paths and to execute code remotely on the database host, potentially compromising confidentiality, integrity, and availability of the system. The vulnerability is explicitly described as a critical function that can be abused by unauthenticated users.

The affected product is Apache IoTDB by the Apache Software Foundation. All releases from 2.0.0 up to, but not including, 2.0.11 are vulnerable. Systems running any of these versions are susceptible to the described remote code execution and path traversal attack.

The CVSS score of 9.8 and EPSS score of < 1% for this vulnerability indicate that while its potential impact is high, the current exploitation probability is very low and it is not listed in the CISA KEV catalog, indicating that no publicly available exploit has been documented. However, the missing authentication and critical nature of the RPC function imply a high likelihood of remote exploitation if an attacker can reach the IoTDB instance over the network. The absence of a KEV listing does not diminish the risk posed by the vulnerability, as it still allows unauthenticated users to gain code execution privileges on the target system.