CVE-2025-55017

CriticalCVSS 9.1/10Last modified Sep 29, 2026

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6.

Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
Apache Software FoundationApache IoTDB>= 2.0.0, < 2.0.6; >= 1.0.0, < 1.3.6

References

Timeline

Published
Jun 26, 2026
Last modified
Sep 29, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-550185.8An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.CVE-2025-55029.8A vulnerability, which was classified as critical, has been found in TOTOLINK X15 1.0.0-B20230714.1105. Affected by this issue is the functiCVE-2025-550286.5Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of serCVE-2025-550297.5Malicious scripts could bypass the popup blocker to spam new tabs, potentially resulting in denial of service attacks. This vulnerability waCVE-2025-55038.8A vulnerability, which was classified as critical, was found in TOTOLINK X15 1.0.0-B20230714.1105. This affects the function formMapReboot oCVE-2025-550306.1Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather thCVE-2025-550319.8Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within BluetooCVE-2025-550326.1Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentiallCVE-2025-550336.1Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in XSS attacks. CVE-2025-550348.2General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to executCVE-2025-550356.1Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basicCVE-2025-550367.5When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed
CVE-2025-55017: Critical severity, CVSS 9.1 | Vulnix