{"id":"CVE-2024-48019","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-48019","generatedAt":"2026-10-28T05:58:46.649Z","title":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Doris.","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Doris.\n\n\nApplication administrators can read arbitrary\nfiles from the server filesystem through path traversal.\n\n\nUsers are recommended to upgrade to version 2.1.8, 3.0.3 or later, which fixes the issue.","published":"2025-02-04T19:15:32.000Z","lastModified":"2026-06-17T07:58:07.000Z","status":"Analyzed","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-22","CWE-552"],"affected":["apache/doris"],"epss":{"score":0.01031,"percentile":0.63558,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.03%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://lists.apache.org/thread/p70klgmyrgknhn0t195261wvwv5jw6hr","tags":["Vendor Advisory"],"source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2025/02/04/2","tags":["Mailing List","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-48019","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}