CVE-2026-24014: Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write
Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file write with the permissions of the IoTDB process.
This issue affects Apache IoTDB: from 1.3.3 before 2.0.8.
Users are recommended to upgrade to version 2.0.8, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache IoTDB DataNodeto a version that resolves this vulnerability.Fixed in 2.0.8Patch CVE-2026-24014 - Compensating control
If the internal DataNode RPC port is exposed to an untrusted network, restrict it so only trusted networks/clients can reach it to prevent exploitation of path traversal via Trigger JAR name (CVE-2026-24014).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24014?
CVE-2026-24014 has a risk rating of 55.
How do I fix CVE-2026-24014?
To mitigate CVE-2026-24014, restrict access to the internal DataNode RPC port and validate uploaded JAR file names to prevent path traversal.
What systems are affected by CVE-2026-24014?
CVE-2026-24014 affects Apache IoTDB installations with an exposed internal RPC interface.
What type of vulnerability is CVE-2026-24014?
CVE-2026-24014 is a path traversal vulnerability that allows for arbitrary file write through malicious file uploads.
How can attackers exploit CVE-2026-24014?
Attackers can exploit CVE-2026-24014 by using path traversal sequences in the JAR file name when creating Trigger instances through the RPC interface.