CVE-2024-48019

MEDIUM

Apache Doris < 2.1.8 - Path Traversal

Title source: rule

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Doris. Application administrators can read arbitrary files from the server filesystem through path traversal. Users are recommended to upgrade to version 2.1.8, 3.0.3 or later, which fixes the issue.

References (2)

[Vendor Advisory] https://lists.apache.org/thread/p70klgmyrgknhn0t195261wvwv5jw6hr

[Mailing List, Vendor Advisory] http://www.openwall.com/lists/oss-security/2025/02/04/2

Scores

CVSS v3 5.4

EPSS 0.0121

EPSS Percentile 78.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Classification

CWE

CWE-22 CWE-552

Status published

Affected Products (1)

apache/doris < 2.1.8

Timeline

Published Feb 04, 2025

Tracked Since Feb 18, 2026