Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Apache IoTDB: Attackers Can Write Files Anywhere

CVE-2026-40005 · published 4 months ago
Summary

Apache IoTDB versions 1.0.0 to 2.0.9 are affected. If exploited, an attacker could create or overwrite files on your system, potentially causing data loss or system compromise. To fix this, update to version 2.0.10.

What to do
  • Update apache software foundation apache iotdb to version 2.0.10 or later.
Affected software
VendorProductAffected versions
apache software foundation apache iotdb < 2.0.10
Original advisory text
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions ...
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB.
An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API.


This issue affects Apache IoTDB: from 1.0.0 before 2.0.10.

Users are recommended to upgrade to version 2.0.10, which fixes the issue.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published10 Jul 2026
Updated7 Nov 2026
First seen10 Jul 2026
Sources
CVE-2026-40005 · NVD
CVE-2026-40005 · MITRE
Track software like this
Free during beta