--- cve: "CVE-2025-24907" severity: "MEDIUM" cvss: 6.8 epss: "41%" vendor: "Hitachi Vantara" kev: false exploited: false published: "2025-04-16 23:15:45" tags: [cve, security, medium] source: tsecurity.de CVE-Dossier exported: "2026-09-18T00:31:05+02:00" --- # CVE-2025-24907 > 6.8 MEDIUM ## Beschreibung Overview   The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35)   Description   Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the CGG Draw API.   Impact   This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory. ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Hoch | good | | UI Interaktion | Keine | bad | | S Scope | Verändert | bad | | C Vertraulichkeit | Keine | good | | I Integrität | Hoch | bad | | A Verfügbarkeit | Keine | good | ## Schwachstellen-Klasse - **CWE-35** — Path Traversal: '.../...//' The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. ## Referenzen - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2025-24907) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_