CVE-2025-48977: Apache Ignite REST API Has a Relative Path Traversal Vulnerability

May 28, 2026 (updated July 1, 2026)

Relative Path Traversal vulnerability in Apache Ignite REST API.

Authenticated REST API users can read any file on the server with “cmd=log” command and a log path crafted in a certain way. This issue affects Apache Ignite: from 2.0.0 through 2.17.0.

Users are recommended to upgrade to version 2.18.0, which fixes the issue.

References

github.com/advisories/GHSA-v45h-mqf4-6939
github.com/apache/ignite/commit/5c42c7a303937844179ad470edb35c1ad1cee6ab
lists.apache.org/thread/hgct6918sowd8l58yjohryhpxx81t4n1
nvd.nist.gov/vuln/detail/CVE-2025-48977

Code Behaviors & Features

Detect and mitigate CVE-2025-48977 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →