CVE-2026-24014: Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-06 · updated 2026-10-25
Weakness: CWE-284

Description

Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process. This issue affects Apache IoTDB: from 1.3.3 before 2.0.8. Users are recommended to upgrade to version 2.0.8, which fixes the issue.

Affected products

Apache Software Foundation Apache IoTDB: from 1.3.3 before 2.0.8 — fixed in 2.0.8

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache IoTDB 2.0.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-24014 or the next vulnerability affects your stack