CVE-2018-8009: Path Traversal in Hadoop
Summary
CVE-2018-8009: Path Traversal in Hadoop. Affects org.apache.hadoop:hadoop-main across 5 version ranges.
< 2.7.7
>= 2.8.0, < 2.8.5
>= 2.9.0, < 2.9.2
>= 3.0.0, < 3.0.3
>= 3.1.0, < 3.1.1
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Hadoop is an open-source software framework used for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics. The vulnerability identified as CVE-2018-8009 affects multiple versions of Apache Hadoop, including 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, and 0.23.0 to 0.23.11. This vulnerability is related to a path traversal issue that can be exploited through the zip slip vulnerability in places that accept a zip file.
Vulnerability Detail
The path traversal vulnerability in Apache Hadoop allows an attacker to manipulate file paths and access files outside the intended directory. By crafting a malicious zip file, an attacker can traverse directories and potentially access sensitive files on the system. This can lead to unauthorized disclosure of information, modification of critical files, or even remote code execution. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
Latest published version: 3.5.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.72.7.7 -
>= 2.8.0, < 2.8.52.8.5 -
>= 2.9.0, < 2.9.22.9.2 -
>= 3.0.0, < 3.0.33.0.3 -
>= 3.1.0, < 3.1.13.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a temporary workaround can be implemented. It is advised to restrict access to the affected components and ensure that only trusted zip files are processed. Additionally, input validation should be performed to prevent path traversal attacks. Here is an example of input validation code in Java:
String zipFilePath = getZipFilePath();
if (!zipFilePath.contains("..") && zipFilePath.endsWith(".zip")) {
// Process the zip file
} else {
// Reject the file
}
Conclusion
The path traversal vulnerability in Apache Hadoop can have serious consequences, including unauthorized access to sensitive files and remote code execution. It is crucial to promptly update to the patched versions of Apache Hadoop to mitigate the risk of exploitation. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.apache.hadoop:hadoop-main →
FAQ
Apache Hadoop is an open-source software framework used for distributed storage and processing of large datasets. It provides a scalable and reliable platform for big data analytics.
Path traversal vulnerability, also known as directory traversal, allows an attacker to access files or directories outside the intended scope of an application. It occurs when user input is not properly validated or sanitized, allowing attackers to manipulate file paths and access sensitive information.
The zip slip vulnerability is a specific type of path traversal vulnerability that occurs when extracting files from a zip archive. In the case of this Apache Hadoop vulnerability, the zip slip vulnerability can be exploited in places that accept a zip file, allowing an attacker to traverse directories and potentially access sensitive files.
Exploiting this vulnerability can lead to unauthorized disclosure of sensitive information, modification of critical files, or even remote code execution. It poses a significant risk to the confidentiality, integrity, and availability of the affected system.
To mitigate the risk of exploitation, it is recommended to upgrade to the patched versions of Apache Hadoop. If immediate upgrade is not feasible, restrict access to the affected components, validate input to prevent path traversal attacks, and ensure that only trusted zip files are processed.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.hadoop:hadoop-main.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.