Apache IoTDB versions from 1.0.0 up to but not including 1.3.6, and from 2.0.0 up to but not including 2.0.7, contain a Path Traversal vulnerability (CWE-22). This flaw allows an attacker to access files outside the intended directory restrictions. The issue is fixed in versions 1.3.6 and 2.0.7. The vulnerability has a high CVSS score of 9.1, indicating critical severity with network attack vector, no privileges required, and no user interaction needed.