CVE-2015-5531
Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch
CVE-2015-5531 is a medium vulnerability (CVSS 5.0) in Elasticsearch, published August 17, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 94.8%, the 99th percentile. Fixed in org.elasticsearch:elasticsearch 1.6.1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 94.8%EPSS, 99th percentile
- Exploitation
- None known5 public exploits
- Fixed in
1.6.1org.elasticsearch:elasticsearch +1 more
Description
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.elasticsearch:elasticsearchMaven | through 1.6.0 | 1.6.1 |
org.elasticsearch:elasticsearchMaven | before 1.6.1, plus listed versions 0.10.00.11.00.12.00.12.10.13.0 Show 45 moreShow less0.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.16.20.16.30.16.40.16.50.17.00.17.10.17.100.17.20.17.30.17.40.17.50.17.60.17.70.17.80.17.90.18.00.18.10.18.20.18.30.18.40.18.50.18.60.18.70.19.00.19.0.RC10.19.0.RC20.19.0.RC30.19.10.19.100.19.110.19.120.19.20.19.30.19.4 | 1.6.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | ElasticSearch 1.6.0 - Arbitrary File Download | 2015-10-02 |
| PoC in GitHub | xpgdgit/CVE-2015-5531 | 2022-08-01 |
| PoC in GitHub | MoCh3n/CVE-2015-5531-POC | 2022-09-21 |
| Nuclei | ElasticSearch <1.6.1 - Local File Inclusion | |
| Metasploit | ElasticSearch Snapshot API Directory Traversal |
What each source reports
NVD Score used
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
- Record
CVE-2015-5531- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE ListNo score
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
- Record
CVE-2015-5531- Updated
- 2026-11-02
EUVDEUVD-2022-4392No score
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
- Record
EUVD-2022-4392- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jjq8-vfjq-j6v4No score
Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
- Record
GHSA-jjq8-vfjq-j6v4- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-jjq8-vfjq-j6v4No score
Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
- Record
GHSA-jjq8-vfjq-j6v4- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-5531No score
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
- Record
UBUNTU-CVE-2015-5531- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| affected, exploits | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/archive/1/536017/100/0/threaded
packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html
elastic.co/community/security
Left out here: 72 versions. The JSON record has them.