CVE-2025-48977 — Apache Ignite: REST HTTP arbitrary file read vulnerability

CVE-2025-48977

Apache Ignite: REST HTTP arbitrary file read vulnerability PUBLISHED

Description (CNA)

Relative Path Traversal vulnerability in Apache Ignite REST API. Authenticated REST API users can read any file on the server with "cmd=log" command and a log path crafted in a certain way. This issue affects Apache Ignite: from 2.0.0 through 2.17.0. Users are recommended to upgrade to version 2.18.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Ignite	affected 2.0.0 through 2.17.0

CWE

CWE-23

References

https://lists.apache.org/thread/hgct6918sowd8l58yjohryhpxx81t4n1

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/05/28/3