CVE-2025-24907CWE-35

Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal

Medium · published April 16, 2025

CVSS v3.1
6.8
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

Overview

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API.

Impact

This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00436 · 36.9th percentile
Weakness
CWE-35 · Path Traversal: '.../...//'
Published
2025-04-16T22:39Z
EPSS history
Timeline
  • 16 APR 22:39Z
    Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal
    cvelistv5