CVE-2025-48977

Technical summary

CVE-2025-48977 is a relative path traversal vulnerability (CWE-23) in Apache Ignite's REST API. The vulnerability exists in the 'cmd=log' command handler, which fails to properly validate or sanitize the log path parameter. Authenticated API users can craft malicious path sequences (such as '../') to traverse outside the designated log directory and read arbitrary files with the privileges of the Ignite process. The CVSS 3.1 score of 6.5 reflects a network-exploitable vulnerability requiring valid authentication, with high confidentiality impact but no integrity or availability risk.

Business impact

Successful exploitation enables unauthorized disclosure of sensitive data stored on Ignite servers, including application logs, configuration files, credentials, database connection strings, and other proprietary information. For organizations using Ignite in production environments, this creates a significant insider threat and compliance risk—especially in regulated industries handling PII or financial data. The requirement for authentication limits exposure to trusted users or those who have compromised valid API credentials, but the breadth of accessible files amplifies the damage potential of credential compromise.

Affected systems

Apache Ignite versions 2.0.0 through 2.17.0 are vulnerable. Version 2.18.0 and later contain the fix. The vulnerability affects any Ignite deployment that exposes the REST API to authenticated users, including cloud-hosted and on-premises instances. Installations where the REST API is restricted to internal networks face lower risk than those with broader access controls.

Exploitability

Exploitation requires valid REST API authentication credentials and network access to the REST endpoint. No special privileges or user interaction is needed beyond authentication. The attack is straightforward—an authenticated attacker crafts a single REST API request with a malicious log path. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no active, widespread exploitation has been publicly reported, but the simplicity of the attack means exploitation tools could be rapidly developed or adapted.

Remediation

Upgrade Apache Ignite to version 2.18.0 or later. Organizations unable to patch immediately should implement network-level access controls to restrict REST API access to trusted internal networks only, implement and enforce strong authentication for REST API access, audit REST API logs for suspicious log path parameters or directory traversal attempts, and consider disabling the REST API entirely if not actively used.

Patch guidance

Apply the vendor-recommended upgrade to Apache Ignite 2.18.0. Review and test the upgrade in a staging environment before production deployment, as it may include other changes. Verify patch application by confirming the version number post-upgrade. Organizations should coordinate the upgrade with their change management process and plan for service restarts if required. Validate that REST API functionality works as expected after patching.

Detection guidance

Monitor REST API access logs for cmd=log requests containing path traversal sequences such as '../', '..\', or encoded variants (%2e%2e%2f). Inspect the log path parameter for attempts to escape the expected log directory. Correlate suspicious REST API calls with user authentication records to identify the source. Network intrusion detection systems can be tuned to flag requests with traversal patterns to Ignite REST endpoints. Baseline normal log query patterns in your environment and alert on deviations.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants prompt attention because it enables confidential data exfiltration from production systems. Organizations with strict data protection requirements or those running Ignite in sensitive environments should prioritize patching. The authentication requirement reduces the attack surface compared to unauthenticated vulnerabilities, but the high confidentiality impact and ease of exploitation—once credentials are obtained—make this a solid candidate for near-term remediation cycles. Factor internal REST API exposure and credential hygiene into your risk prioritization.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects: network-based attack vector requiring no special network positioning, low attack complexity with no special conditions, requirement for valid authentication (reducing exposure), no user interaction needed, unauthorized information disclosure with high confidentiality impact, and no integrity or availability impact. The score appropriately captures a credentialed, read-only information disclosure risk that is serious but not as critical as vulnerabilities enabling unauthenticated access or system compromise.

Frequently asked questions