Medium severity5.3NVD Advisory· Published Feb 14, 2024· Updated Jun 17, 2026

CVE-2024-25125

Description

Digdag is an open source tool that to build, run, schedule, and monitor complex pipelines of tasks across various platforms. Treasure Data's digdag workload automation system is susceptible to a path traversal vulnerability if it's configured to store log files locally. This issue may lead to information disclosure and has been addressed in release version 0.10.5.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.digdag:digdag-serverMaven	< 0.10.5.1	0.10.5.1

Affected products

Treasuredata/Digdagv52 versions
< 0.10.5.1+ 1 more
- (no CPE)range: < 0.10.5.1
- cpe:2.3:a:treasuredata:digdag:*:*:*:*:*:*:*:*range: <0.10.5.1
ghsa-coords
pkg:maven/io.digdag/digdag-server
Range: < 0.10.5.1

Patches

Vulnerability mechanics

References

github.com/treasure-data/digdag/commit/eae89b0daf6c62f12309d8c7194454dfb18cc5c3nvdPatchWEB
github.com/advisories/GHSA-5mp4-32rr-v3x5ghsaADVISORY
github.com/treasure-data/digdag/security/advisories/GHSA-5mp4-32rr-v3x5nvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2024-25125ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.024
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000