Path Traversal Vulnerability in Hitachi Vantara Pentaho Data Integration & Analytics
CVE-2025-24908

6.8MEDIUM

Key Information:

Vendor

Hitachi
Status
Pentaho Data Integration & Analytics
Vendor
CVE Published:
16 April 2025

What is CVE-2025-24908?

A vulnerability in Hitachi Vantara Pentaho Data Integration & Analytics prior to version 10.2.0.2 allows attackers to manipulate file paths through the UploadFile service. By exploiting improper sanitation of user-inputted data, such as '.../...//', an attacker can navigate outside the intended restricted directory. This results in unauthorized access to files and directories on the file system, posing a significant security risk.

Affected Version(s)

Pentaho Data Integration & Analytics 1.0 <= 9.3.*

Pentaho Data Integration & Analytics 10.0 < 10.2.0.2

References

https://support.pentaho.com/hc/en-us/articles/35783399569...

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.
CVE-2025-24908 : Path Traversal Vulnerability in Hitachi Vantara Pentaho Data Integration & Analytics