CVE-2025-24908

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Overview

 

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)

 

Description

 

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service.

 

Impact

 

This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-35

Affected software

No affected versions have been published.

Timeline

Published
Apr 16, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-249094.4Overview   The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is uCVE-2025-24915.4A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/comCVE-2025-249104.9Overview   XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of CVE-2025-249114.9Overview   XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of CVE-2025-249123.7hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker iCVE-2025-249147.8When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sCVE-2025-249157.8When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permiCVE-2025-249167.8When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did notCVE-2025-249177.8In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a locCVE-2025-249186.7Improper link resolution before file access ('link following') for some Intel(R) Server Configuration Utility software and Intel(R) Server FCVE-2025-249198.1A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 aCVE-2025-24929.2An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially le