CVE-2026-40005 is a path traversal vulnerability in Apache IoTDB that improperly limits pathname access to restricted directories. Exploitation allows an unauthenticated attacker to write arbitrary files to locations where the IoTDB process has write permissions, potentially leading to code execution or system compromise. The vulnerability affects Apache IoTDB versions from 1.0.0 before 2.0.10. The issue is resolved by upgrading to version 2.0.10.

Successful exploitation can result in an attacker writing arbitrary files on the system with the permissions of the IoTDB process, leading to high confidentiality and integrity impact. There is no direct availability impact reported. The CVSS score is 9.1 (critical), reflecting the network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Users should upgrade Apache IoTDB to version 2.0.10 or later, where this vulnerability is fixed. No other mitigations or temporary workarounds are indicated in the provided data.