PT-2026-44225 · Apache · Apache Ignite

Published 2026-05-28 · Updated 2026-05-28 · CVE-2025-48977

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Apache Ignite versions 2.0.0 through 2.17.0

Description A relative path traversal issue exists in the REST API. Authenticated users can read arbitrary files on the server by utilizing the "cmd=log" command with a specifically crafted log path. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables and parameters.

Recommendations Upgrade to version 2.18.0.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2025-48977

Affected Products

Apache Ignite

References · 5

• https://lists.apache.org/thread/hgct6918sowd8l58yjohryhpxx81t4n1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48977 · Security Note
• https://t.me/cveNotify/164994 · Telegram Post
• https://t.me/cveNotify/164988 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/28/3 · Note