Vulnerability · Published May 28, 2026 · Assigned by apache
CVE-2025-48977Apache Ignite: REST HTTP arbitrary file read vulnerability
High 8.5
In plain English
A high-severity security flaw in Apache Ignite from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Relative Path Traversal vulnerability in Apache Ignite REST API. Authenticated REST API users can read any file on the server with "cmd=log" command and a log path crafted in a certain way. This issue affects Apache Ignite: from 2.0.0 through 2.17.0. Users are recommended to upgrade to version 2.18.0, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.ignite:ignite-core | 2.18.0 | GHSA-v45h-mqf4-6939 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Ignite | 2.0.0 – through 2.17.0 |
Weakness: CWE-23 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H