CVE-2025-24908CWE-35

Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal

Medium · published April 16, 2025

CVSS v3.1
6.8
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

Overview

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)

Description

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service.

Impact

This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00502 · 42.0th percentile
Weakness
CWE-35 · Path Traversal: '.../...//'
Published
2025-04-16T22:27Z
EPSS history
Timeline
  • 16 APR 22:27Z
    Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal
    cvelistv5