CVE-2024-2221

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-2221
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2221.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-2221
Published
2024-04-10T17:15:54.633Z
Modified
2026-04-10T05:09:06.521916Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the /collections/{COLLECTION}/snapshots/upload endpoint, specifically through the snapshot parameter. This vulnerability allows attackers to upload and overwrite any file on the filesystem, leading to potential remote code execution. This issue affects the integrity and availability of the system, enabling unauthorized access and potentially causing the server to malfunction.

References

Affected packages

Git / github.com/qdrant/qdrant

Affected ranges

Type
GIT
Repo
https://github.com/qdrant/qdrant
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7aa164bd2dda1c0fc9bf3a0da42e656c95c2e52a
Fixed
e6411907f0ecf3c2f8ba44ab704b9e4597d9705d
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.7.4"
        }
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.1
v0.11.0
v0.11.1
v0.11.2
v0.11.3
v0.11.4
v0.11.5
v0.11.6
v0.11.7
v0.2.0
v0.2.1
v0.3.0
v0.3.1
v0.3.2
v0.3.4
v0.3.5
v0.3.6
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.5.1
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.9.0
v0.9.1
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2221.json"