The vulnerability identified as CVE-2025-64152 in Apache IoTDB involves CWE-22, which is an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This flaw affects Apache IoTDB versions starting from 1.0.0 up to but not including 1.3.6, and versions from 2.0.0 up to but not including 2.0.7. The vulnerability allows an attacker to potentially access files or directories outside the intended restricted directory by manipulating file path inputs. The vendor has addressed this issue in Apache IoTDB versions 1.3.6 and 2.0.7.

This vulnerability could allow unauthorized access to files or directories outside of the intended restricted directory in affected Apache IoTDB versions. Such unauthorized access may lead to information disclosure or other security breaches depending on the environment and usage of the affected software.

Users should upgrade Apache IoTDB to version 1.3.6 or 2.0.7 or later, where this path traversal vulnerability has been fixed. Patch status is confirmed by the vendor's recommendation to upgrade to these versions.