Skip to content
fr Sign in
Not rated

CVE-2024-52012 Relative Path Traversal vulnerability in Apache Solr

Description

Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API.  Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.   This issue affects Apache Solr: from 6.6 through 9.7.0. Users are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's "Rule-Based Authentication Plugin" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.

Affected products and versions

Product Affected versions Fixed in
Apache Solr 6.6 6.6 → 9.7.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Solr

The 24 CVEs of Apache Solr →
CVE-2026-44825 Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0… 8.1 High CVE-2026-22022 Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable… Not rated CVE-2026-22444 The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters,… Not rated CVE-2025-24814 Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use… Not rated
Track this CVE