Changes.Watch~ upgrade verdicts ~
Free digest
Research1 in 10 popular npm releases needed a hotfix

critical vulnerability

Apache IoTDB has a Path Traversal vulnerability

Fix availableCritical · CVSS 9.1EPSS 0.54%

Published Jun 26, 2026 · updated Nov 3, 2026

What to do

  1. Upgrade to a fixed version: org.apache.iotdb:iotdb-server 2.0.6, org.apache.iotdb:iotdb-server 1.3.6.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.apache.iotdb:iotdb-server

Vulnerable versions
>= 2.0.0, < 2.0.6
Fixed in
2.0.6

Check your project: mvn dependency:tree -Dincludes=org.apache.iotdb:iotdb-server

Mavenorg.apache.iotdb:iotdb-server

Vulnerable versions
>= 1.0.0, < 1.3.6
Fixed in
1.3.6

Check your project: mvn dependency:tree -Dincludes=org.apache.iotdb:iotdb-server

Sources

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

← All critical vulnerabilities