Apache Ignite REST API Has a Relative Path Traversal Vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-48977 · ADVISORY
• apache/ignite commit 5c42c7a · WEB
• apache/ignite · PACKAGE
• lists.apache.org/thread/hgct6918sowd8l58yjohryhpxx81t4n1 · WEB
• openwall.com/lists/oss-security/2026/05/28/3 · WEB

More vulnerabilities in org.apache.ignite:ignite-core

• CVE-2024-52577CRITICAL 9.0In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vu…
• CVE-2020-1963CRITICAL 9.1Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to acces…
• CVE-2018-8018CRITICAL 9.8In Apache Ignite before 2.4.8 and 2.5.x before 2.5.3, the serialization mechanism does not have a list of classes allowed for serialization/…
• CVE-2018-1295CRITICAL 9.8In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, whic…
• CVE-2017-7686HIGH 7.5Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional func…