8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48977

CVE-2025-48977: Apache Ignite REST API Has a Relative Path Traversal Vulnerability

Relative Path Traversal vulnerability in Apache Ignite REST API.

Authenticated REST API users can read any file on the server with "cmd=log" command and a log path crafted in a certain way. This issue affects Apache Ignite: from 2.0.0 through 2.17.0.

Users are recommended to upgrade to version 2.18.0, which fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48977

CVE-2025-48977:

8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.ignite:ignite-core	maven	>= 2.0.0, < 2.18.0	2.18.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic relative path traversal in the Apache Ignite REST API's log handling functionality. The analysis of the patch commit 5c42c7a303937844179ad470edb35c1ad1cee6ab clearly pinpoints the flaw and the fix. The core of the vulnerability is in the GridLogCommandHandler.java file, specifically within the handleAsync method. Previously, this method validated the user-provided log file path by simply checking if it started with the igniteHome directory path. This is a common but flawed approach, as it can be bypassed using directory traversal notations like .. or their URL-encoded equivalents (%2e%2e).

The patch introduces a new private static method, resolveFilePath, which properly sanitizes the input path. This method normalizes the URI to resolve encoded characters and then gets the canonical path of the file, which resolves any .. sequences. The handleAsync method was updated to use this new sanitization function before performing the security check, thus ensuring that the path is confined within the intended directory. The vulnerable function is therefore org.apache.ignite.internal.processors.rest.handlers.log.GridLogCommandHandler.handleAsync, as it was the entry point for processing the malicious user input.

Vulnerable functions

org.apache.ignite.internal.processors.rest.handlers.log.GridLogCommandHandler.handleAsync

modules/core/src/main/java/org/apache/ignite/internal/processors/rest/handlers/log/GridLogCommandHandler.java

The `handleAsync` method processes REST requests for log files. The vulnerability lies in its handling of the file path provided by the user. The original code used a simple `startsWith` check to validate if the requested path was within the configured `igniteHome`. This check was insufficient as it did not account for path traversal sequences (e.g., `../`, URL-encoded characters). An authenticated attacker could craft a malicious path to bypass this check and access arbitrary files on the server's filesystem.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.