CVE-2025-55017: Apache IoTDB Path Traversal Vulnerability

CVE-2025-55017 Overview

CVE-2025-55017 is a path traversal vulnerability in Apache IoTDB, the open-source time-series database used in Internet of Things (IoT) deployments. The flaw stems from improper limitation of a pathname to a restricted directory [CWE-22]. Attackers can exploit the issue over the network without authentication or user interaction. The vulnerability affects Apache IoTDB versions from 1.0.0 before 1.3.6 and from 2.0.0 before 2.0.6. The Apache Software Foundation has released patched versions 1.3.6 and 2.0.6.

Critical Impact
Unauthenticated network attackers can traverse directories to read or write files outside the intended scope, threatening data confidentiality and integrity on IoTDB servers.

Affected Products

Apache IoTDB versions 1.0.0 through 1.3.5
Apache IoTDB versions 2.0.0 through 2.0.5
Deployments exposing IoTDB endpoints to untrusted networks

Discovery Timeline

2026-06-26 - CVE-2025-55017 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2025-55017

Vulnerability Analysis

Apache IoTDB fails to properly validate user-supplied path components before using them to resolve file system locations. An attacker who supplies crafted input containing directory traversal sequences such as ../ can escape the intended base directory. The Common Weakness Enumeration classifies this bug as [CWE-22], Improper Limitation of a Pathname to a Restricted Directory.

The vulnerability affects both the 1.x and 2.x release lines, indicating the flaw exists in shared path-handling logic carried across major versions. Successful exploitation can expose configuration files, credentials, and time-series data stored on the host. Attackers may also overwrite files reachable by the IoTDB process, undermining data integrity across IoT telemetry pipelines.

Root Cause

The root cause is missing or insufficient canonicalization of file paths derived from network-facing inputs. IoTDB constructs file paths by concatenating attacker-controlled strings with a base directory without normalizing traversal sequences. The Apache IoTDB project addressed the flaw in versions 1.3.6 and 2.0.6.

Attack Vector

The attack vector is network based and requires no authentication or user interaction. An attacker sends a crafted request to a reachable IoTDB service endpoint containing traversal sequences within a path parameter. The service resolves the manipulated path and reads or writes files outside the restricted directory. Details are described in the Apache Mailing List Thread and the OpenWall OSS Security Update.

Detection Methods for CVE-2025-55017

Indicators of Compromise

Requests to IoTDB endpoints containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f
Access to sensitive files outside the IoTDB data directory, including configuration files and system credentials
Unexpected file writes or modifications performed by the IoTDB service account
IoTDB log entries showing path resolution to locations outside the configured storage root

Detection Strategies

Inspect application and reverse-proxy logs for traversal patterns in request URIs and body parameters targeting IoTDB APIs
Correlate IoTDB process file access with expected data directories using endpoint telemetry
Deploy behavioral endpoint detection such as Singularity Endpoint to identify anomalous file access performed by the IoTDB service process
Ingest IoTDB, network, and host logs into Singularity Data Lake to run queries that surface path traversal attempts across the environment

Monitoring Recommendations

Alert on any IoTDB request parameter containing traversal metacharacters after URL and Unicode decoding
Monitor egress and inter-service traffic from IoTDB hosts for exfiltration of files outside the database directory
Track version metadata across the IoTDB fleet to identify hosts running unpatched 1.x or 2.x releases

How to Mitigate CVE-2025-55017

Immediate Actions Required

Upgrade Apache IoTDB to version 1.3.6 for 1.x deployments or 2.0.6 for 2.x deployments
Restrict network access to IoTDB service ports so only trusted clients and applications can connect
Audit IoTDB storage, configuration, and log directories for signs of unauthorized file access or modification
Rotate credentials and secrets that may have resided on affected hosts

Patch Information

The Apache IoTDB project fixed the vulnerability in versions 1.3.6 and 2.0.6. Users are directed to upgrade to a fixed release. Release details are available in the Apache Mailing List Thread.

Workarounds

Place IoTDB behind a reverse proxy or web application firewall that rejects requests containing path traversal sequences
Enforce network segmentation so IoTDB services are unreachable from untrusted networks and the public internet
Run the IoTDB process under a least-privilege service account with file system permissions limited to the data directory

bash

# Example: block traversal sequences at an nginx reverse proxy fronting IoTDB
location / {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|\.\.%2f)") {
        return 400;
    }
    proxy_pass http://iotdb_backend;
}