GHSA-4p5m-gvpf-f3x5

Suggest an improvement
Source
https://github.com/advisories/GHSA-4p5m-gvpf-f3x5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-4p5m-gvpf-f3x5/GHSA-4p5m-gvpf-f3x5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4p5m-gvpf-f3x5
Aliases
Downstream
CGA (10)
Published
2025-01-27T09:30:35Z
Modified
2026-09-10T03:50:56Z
Severity
  • 6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
Apache Solr Relative Path Traversal vulnerability
Details

Relative Path Traversal vulnerability in Apache Solr.

Solr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the "configset upload" API.  Commonly known as a "zipslip", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.   This issue affects Apache Solr: from 6.6 through 9.7.0.

Users are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's "Rule-Based Authentication Plugin" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.

Database specific 
{
    "cwe_ids":  [
        "CWE-23"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-01-27T17:22:43Z",
    "nvd_published_at":  "2025-01-27T09:15:14Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.apache.solr:solr-core

Package

Name
org.apache.solr:solr-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.solr/solr-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.6
Fixed
9.8.0

Affected versions

6.*
6.6.0
6.6.1
6.6.2
6.6.3
6.6.4
6.6.5
6.6.6
7.*
7.0.0
7.0.1
7.1.0
7.2.0
7.2.1
7.3.0
7.3.1
7.4.0
7.5.0
7.6.0
7.7.0
7.7.1
7.7.2
7.7.3
8.*
8.0.0
8.1.0
8.1.1
8.2.0
8.3.0
8.3.1
8.4.0
8.4.1
8.5.0
8.5.1
8.5.2
8.6.0
8.6.1
8.6.2
8.6.3
8.7.0
8.8.0
8.8.1
8.8.2
8.9.0
8.10.0
8.10.1
8.11.0
8.11.1
8.11.2
8.11.3
8.11.4
9.*
9.0.0
9.1.0
9.1.1
9.2.0
9.2.1
9.3.0
9.4.0
9.4.1
9.5.0
9.6.0
9.6.1
9.7.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-4p5m-gvpf-f3x5/GHSA-4p5m-gvpf-f3x5.json"