Path Traversal Vulnerability in Apache IoTDB by Apache
CVE-2026-40005

9.1CRITICAL

Key Information:

Vendor

Apache
Status
Apache Iotdb
Vendor
CVE Published:
10 July 2026

What is CVE-2026-40005?

A Path Traversal vulnerability in Apache IoTDB allows an attacker to write arbitrary files on the server where IoTDB operates, exploiting unsafe API methods. This can lead to unauthorized access to sensitive data or system files, particularly in scenarios where the IoTDB process has write permissions in unintended locations. Users are advised to upgrade to version 2.0.10 to mitigate this risk, ensuring their systems remain secure.

Affected Version(s)

Apache IoTDB 1.0.0 < 2.0.10

References

https://lists.apache.org/thread/zw2vkbmy5xkf5y8g237v81hrs...
vendor-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrea Cosentino
.