CVE-2025-48977CWE-23

CVE-2025-48977

Medium · published May 28, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

Relative Path Traversal vulnerability in Apache Ignite REST API.

Authenticated REST API users can read any file on the server with "cmd=log" command and a log path crafted in a certain way.

This issue affects Apache Ignite: from 2.0.0 through 2.17.0.

Users are recommended to upgrade to version 2.18.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00527 · 43.8th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2026-05-28T14:16Z
Affected products (1)
ProductVersionsFixed in
apache/ignite≥ 2.0.0, < 2.18.02.18.0
References (2)
https://lists.apache.org/thread/hgct6918sowd8l58yjohryhpxx81t4n1 · [email protected]http://www.openwall.com/lists/oss-security/2026/05/28/3 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 28 MAY 08:58Z
    Apache Ignite: REST HTTP arbitrary file read vulnerability
    cvelistv5