CVE-2025-48977: Apache Ignite REST API Relative Path Traversal Vulnerability
Summary
CVE-2025-48977: Apache Ignite REST API Has a Relative Path Traversal Vulnerability. Affects org.apache.ignite:ignite-core versions >= 2.0.0, < 2.18.0. Fixed in 2.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ignite is an open-source distributed database and computing platform designed to provide high-performance, scalable, and in-memory data processing capabilities. It allows users to perform real-time analytics and transactions across large datasets. However, versions from 2.0.0 to 2.17.0 are susceptible to a relative path traversal vulnerability in its REST API, which can be exploited by authenticated users.
Vulnerability Detail
The vulnerability arises from the ability of authenticated users to execute the 'cmd=log' command with a specially crafted log path. This allows them to read arbitrary files on the server, potentially exposing sensitive information. The issue is classified under CWE-23, indicating a risk of unauthorized file access. If exploited, this vulnerability could lead to data leakage and compromise the integrity of the server's file system.
How To Fix
Minimum fixed version
2.18.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the REST API for untrusted users and to monitor logs for any unauthorized access attempts. Additionally, consider implementing file access controls on the server to limit exposure.
Conclusion
The Apache Ignite REST API vulnerability (CVE-2025-48977) poses a significant risk to users of versions 2.0.0 through 2.17.0. It is crucial to upgrade to version 2.18.0 or later to mitigate this risk and protect sensitive data from unauthorized access.
See every vulnerability recorded for org.apache.ignite:ignite-core →
FAQ
The CVSS score for this vulnerability is 6.5, indicating a high severity level.
The affected versions are from 2.0.0 through 2.17.0.
Exploitation can lead to unauthorized access to sensitive files on the server, potentially compromising data integrity and confidentiality.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Vulert is a monitoring tool that uses the pom.xml file to detect and alert in real-time for open-source vulnerabilities in your software.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ignite:ignite-core.
