Advisoriesby IbisApache SolrGHSA-4p5m-gvpf-f3x5
Apache Solr Relative Path Traversal vulnerability
Fix: upgrade to 9.8.0 or later
Relative Path Traversal vulnerability in Apache Solr.
Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.
This issue affects Apache Solr: from 6.6 through 9.7.0.
Users are recommended to upgrade to version 9.8.0, which fixes the issue. Users unable to upgrade may also safely prevent the issue by using Solr's "Rule-Based Authentication Plugin" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.solr:solr-core Maven | >= 6.6, < 9.8.0 | 9.8.0 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-23
- Also known as
- BIT-solr-2024-52012, CVE-2024-52012
More Apache Solr advisories
All Apache Solr
Apache Solr: Insufficient file-access checking in standalone core-creation requestsCVE-2026-22444fixed in 9.10.1Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPluginCVE-2026-22022fixed in 9.10.1Apache Solr vulnerable to Execution with Unnecessary PrivilegesCVE-2025-24814fixed in 9.8.0Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsCVE-2023-50386fixed in 8.11.3 +1Apache Solr can leak certain passwords due to System Property redaction logic inconsistenciesCVE-2023-50291fixed in 8.11.3 +1Apache Solr Schema Designer blindly "trusts" all configsetsCVE-2023-50292fixed in 8.11.3 +1