CVE-2025-24907
CVE-2025-24907 is a medium-severity vulnerability with a CVSS 3.x base score of 6.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-35.
Key facts
- Severity: Medium (CVSS 3.x base score 6.8)
- EPSS exploit prediction: 0% (30th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-11535
- Weakness: CWE-35
- Published:
- Last modified:
Description
Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35) Description Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API. Impact This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Frequently asked questions
- What is CVE-2025-24907?
- Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35) Description Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API. Impact This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
- How severe is CVE-2025-24907?
- CVE-2025-24907 has a CVSS 3.x base score of 6.8, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
- Is CVE-2025-24907 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-24907?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-24907 have an EU (EUVD) identifier?
- Yes. CVE-2025-24907 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-11535.
- When was CVE-2025-24907 published?
- CVE-2025-24907 was published on 2025-04-16 and last updated on 2026-06-17.
References
Other CWE-35 vulnerabilities
- CVE-2025-59793 — Critical (CVSS 9.9): Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to…
- CVE-2026-6074 — Critical (CVSS 9.8): Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the…
- CVE-2025-41723 — Critical (CVSS 9.8): The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the…
- CVE-2025-42937 — Critical (CVSS 9.8): SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An…
- CVE-2025-30515 — Critical (CVSS 9.8): CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations…
- CVE-2026-52703 — Critical (CVSS 9.6): Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.