CVE-2024-2221
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-2221
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2221.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-2221
- Published
- 2024-04-10T17:15:54Z
- Modified
- 2025-07-02T00:29:50.188844Z
- Summary
- [none]
- Details
-
qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the
/collections/{COLLECTION}/snapshots/uploadendpoint, specifically through thesnapshotparameter. This vulnerability allows attackers to upload and overwrite any file on the filesystem, leading to potential remote code execution. This issue affects the integrity and availability of the system, enabling unauthorized access and potentially causing the server to malfunction. - References
Affected packages
Git / github.com/qdrant/qdrant
Affected ranges
- Type
- GIT
- Repo
- https://github.com/qdrant/qdrant
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
v0.*
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.10.4
v0.10.5
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.11.4
v0.11.5
v0.11.6
v0.11.7
v0.2.0
v0.2.1
v0.3.0
v0.3.1
v0.3.2
v0.3.4
v0.3.5
v0.3.6
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.5.1
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.9.0
v0.9.1
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4