CVE-2025-24908 Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal
Attackers can traverse the file system to access files outside the restricted directory via unsanitized input in the UploadFile service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-24908?
CVE-2025-24908 is a medium-severity path traversal vulnerability in Hitachi Vantara Pentaho Data Integration & Analytics, published on 16 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Overview
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)
Description
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service.
Impact
This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Weakness: CWE-35
Which versions are affected by CVE-2025-24908?
How do I fix CVE-2025-24908?
No fix has been published for CVE-2025-24908 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-24908 being exploited?
There is no known exploitation of CVE-2025-24908 in the wild and no public exploit code.
Sources
Also known as GHSA-485r-phmq-84vw.