Advisoriesby IbisiotdbGHSA-f4rq-f4j9-f6rm
Apache IoTDB Vulnerable to Remote Code Execution
Fix: upgrade to 1.3.4 or later
Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB. The attacker who has privilege to create UDF can register malicious function from untrusted URI.
This issue affects Apache IoTDB: from 1.0.0 before 1.3.4.
Users are recommended to upgrade to version 1.3.4, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-iotdb PyPI | >= 1.0.0, < 1.3.4 | 1.3.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- CVE-2024-24780, PYSEC-2025-59
More iotdb advisories
All iotdb
iotdb: path traversalCVE-2026-24014fixed in 2.0.8Authentication Bypass by Spoofing vulnerability in Apache IoTDBCVE-2026-24013fixed in 2.0.8Uncontrolled Resource Consumption vulnerability in Apache IoTDBCVE-2026-24012fixed in 2.0.8Apache IoTDB: Deserialization of untrusted DataCVE-2025-48459fixed in 2.0.5Apache IoTDB Discloses Sensitive Information via Log FilesCVE-2025-26864fixed in 1.3.4 +1Remote Code Execution vulnerability in Apache IoTDB via UDFCVE-2023-46226fixed in 1.3.0