Relative Path Traversal vulnerability in Apache Solr.
Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API. Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.
This issue affects Apache Solr: from 6.6 through 9.7.0.
Users are recommended to upgrade to version 9.8.0, which fixes the issue. Users unable to upgrade may also safely prevent the issue by using Solr's "Rule-Based Authentication Plugin" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2025/01/26/2 | Mailing List Third Party Advisory |
| https://lists.apache.org/thread/yp39pgbv4vf1746pf5yblz84lv30vfxd | Mailing List Vendor Advisory |
Configurations
History
27 Jun 2025, 19:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lists.apache.org/thread/yp39pgbv4vf1746pf5yblz84lv30vfxd - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2025/01/26/2 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:* | |
| First Time |
Apache solr
Apache |
06 Feb 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
27 Jan 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-27 09:15
Updated : 2025-06-27 19:32
NVD link : CVE-2024-52012
Mitre link : CVE-2024-52012
JSON object : View
Products Affected
apache
- solr
CWE
No CWE.