CVE-2025-24908

Overview <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize &amp;#39;.../...//&amp;#39; (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. (CWE-35) <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Description <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Hitachi Vantara Pentaho Data Integration &amp; Analytics versions before 10.2.0.2, including 9.3.x and 8.3.x, do not sanitize a user input used as a file path through the UploadFile service. <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> Impact <br /> <br /> <br /> <br />  <br /> <br /> <br /> <br /> This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.