PT-2025-16915 · Hitachi Vantara · Hitachi Vantara Pentaho Data Integration & Analytics

Published 2025-04-16 · Updated 2025-04-17 · CVE-2025-24908

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Data Integration & Analytics versions prior to 10.2.0.2 Hitachi Vantara Pentaho Data Integration & Analytics versions 9.3.x Hitachi Vantara Pentaho Data Integration & Analytics versions 8.3.x

Description The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.

Recommendations For versions prior to 10.2.0.2, update to version 10.2.0.2 or later to resolve the issue. For versions 9.3.x, update to version 10.2.0.2 or later to resolve the issue. For versions 8.3.x, update to version 10.2.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the UploadFile service until a patch is available.

Fix

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2025-24908

Affected Products

Hitachi Vantara Pentaho Data Integration & Analytics

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-24908 · Security Note
• https://t.me/cvetracker/21822 · Telegram Post
• https://t.me/cvedetector/23190 · Telegram Post
• https://support.pentaho.com/hc/en-us/articles/35783399569421--Resolved-Hitachi-Vantara-Pentaho-Data-Integration-Analytics-Path-Traversal-Versions-before-10-2-0-2-including-9-3-x-Impacted-CVE-2025-24908 · Note
• https://twitter.com/CVEnew/status/1912722260235874424 · Twitter Post