CVE-2026-24014: Apache IoTDB: Untrusted Network File Write Risk

Summary

Apache IoTDB allows an attacker to write files on the system if the internal RPC port is exposed to an untrusted network. This could lead to unauthorized data changes or system compromise. To fix this, update to version 2.0.8 or later.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions
apache software foundation	apache iotdb	< 2.0.8
apache	iotdb	>= 1.3.3, < 2.0.8 `cpe:2.3:a:apache:iotdb::::::::`

Original title

Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC por...

Original description

Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.

This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.

Users are recommended to upgrade to version 2.0.8, which fixes the issue.

Vulnerability type

CWE-284 Improper Access Control

CWE-434 Unrestricted File Upload

https://lists.apache.org/thread/38298f803gb5j9nlhf0l9zkf34o90h3m vendor-advisory
http://www.openwall.com/lists/oss-security/2026/07/06/12 Mailing List Third Party Advisory