Apache IoTDB versions from 1.0.0 before 1.3.6 and from 2.0.0 before 2.0.6 contain a path traversal vulnerability (CVE-2025-55017). This flaw allows an attacker to improperly access restricted directories. The vulnerability is rated critical with a CVSS score of 9.1. Fixed versions 1.3.6 and 2.0.6 address this issue.