CVE-2025-24907: Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal
Overview
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)
Description
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API.
Impact
This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24907?
CVE-2025-24907 has a moderate severity rating due to its path traversal vulnerability.
How do I fix CVE-2025-24907?
To mitigate CVE-2025-24907, upgrade to Hitachi Vantara Pentaho Data Integration & Analytics version 10.2.0.2 or later.
What are the affected versions in CVE-2025-24907?
CVE-2025-24907 affects versions of Hitachi Vantara Pentaho Data Integration & Analytics from 8.3 up to 10.2.0.2.
What type of vulnerability is CVE-2025-24907?
CVE-2025-24907 is a path traversal vulnerability allowing external input to improperly resolve paths outside of restricted directories.
Is there a workaround for CVE-2025-24907?
No official workaround is provided for CVE-2025-24907, and upgrading is the recommended solution.