Vulnerability PYSEC-2026-2081
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
4 months ago
July 06, 2026 at 09:16 AM UTC
No summary available
1.3.3 - 2.0.6
1.3.3 - 2.0.6
Details
Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 months ago
No summary available
1.3.3 - 2.0.6 PYSEC-2026-2079
1.3.3 - 2.0.6 PYSEC-2026-2079
Critical
4 months ago
No summary available
1.3.3 - 2.0.6 PYSEC-2026-2080
1.3.3 - 2.0.6 PYSEC-2026-2080
Medium Risk
1 year ago
Apache IoTDB: Deserialization of untrusted Data
1.0.0 - 2.0.4 GHSA-776q-jw43-fhjx
1.0.0 - 2.0.4 GHSA-776q-jw43-fhjx
Medium Risk
1 year ago
No summary available
1.0.0 - 2.0.4 PYSEC-2025-88
1.0.0 - 2.0.4 PYSEC-2025-88
Medium Risk
1 year ago
Apache IoTDB Discloses Sensitive Information via Log Files
0.10.0 - 1.3.3 and 2.0.1b0 GHSA-5fc3-pqf2-57cx
0.10.0 - 1.3.3 and 2.0.1b0 GHSA-5fc3-pqf2-57cx
Impacted packages
Timeline
Published
4 months ago
July 06, 2026 at 09:16 AM UTC
Fixed (2.0.8)
6 months ago
April 14, 2026 at 01:52 AM UTC
Last Modified
3 months ago
July 08, 2026 at 11:30 AM UTC