This vulnerability in Apache IoTDB (CWE-22) involves improper limitation of a pathname to a restricted directory, commonly known as a path traversal issue. It affects versions starting from 1.0.0 up to but not including 1.3.6, and from 2.0.0 up to but not including 2.0.6. The vulnerability allows an attacker to potentially access files outside the intended directory restrictions. The vendor has fixed the issue in versions 1.3.6 and 2.0.6.

The vulnerability could allow unauthorized access to files outside the intended directory scope, potentially exposing sensitive data or enabling further attacks. No known exploits in the wild have been reported. The exact impact depends on the deployment context and attacker capabilities.

Users should upgrade Apache IoTDB to version 1.3.6 or 2.0.6 or later, which contain fixes for this path traversal vulnerability. No other mitigation details or temporary fixes are provided. Patch status is confirmed by the vendor's recommended upgrade versions.