{"id":"CVE-2024-52012","aliases":["BIT-solr-2024-52012","EUVD-2025-0133","GHSA-4p5m-gvpf-f3x5"],"status":"published","title":"Apache Solr: Configset upload on Windows allows arbitrary path write-access","description":"Relative Path Traversal vulnerability in Apache Solr.\n\nSolr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the \"configset upload\" API.  Commonly known as a \"zipslip\", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.  \nThis issue affects Apache Solr: from 6.6 through 9.7.0.\n\nUsers are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's \"Rule-Based Authentication Plugin\" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.47121,"percentile":0.98842,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-23"],"published":"2025-01-27T08:54:42Z","modified":"2026-10-28T10:54:41Z","fixes":[{"ecosystem":"Maven","package":"org.apache.solr:solr-core","fixed_in":["9.8.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"solr","fixed_in":["9.8.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6"},{"fixed":"9.8.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"solr","ranges":[{"type":"SEMVER","events":[{"introduced":"6.6.0"},{"fixed":"9.8.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.solr:solr-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6"},{"fixed":"9.8.0"}]}],"versions":["6.6.0","6.6.1","6.6.2","6.6.3","6.6.4","6.6.5","6.6.6","7.0.0","7.0.1","7.1.0","7.2.0","7.2.1","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.7.0","7.7.1","7.7.2","7.7.3","8.0.0","8.1.0","8.1.1","8.10.0","8.10.1","8.11.0","8.11.1","8.11.2","8.11.3","8.11.4","8.2.0","8.3.0","8.3.1","8.4.0","8.4.1","8.5.0","8.5.1","8.5.2","8.6.0","8.6.1","8.6.2","8.6.3","8.7.0","8.8.0","8.8.1","8.8.2","8.9.0","9.0.0","9.1.0","9.1.1","9.2.0","9.2.1","9.3.0","9.4.0","9.4.1","9.5.0","9.6.0","9.6.1","9.7.0"]}],"products":[{"vendor":"apache","product":"solr"},{"vendor":"apache software foundation","product":"apache solr"}],"references":[{"url":"https://lists.apache.org/thread/yp39pgbv4vf1746pf5yblz84lv30vfxd","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/01/26/2","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52012","tags":["web","advisory"]},{"url":"https://github.com/apache/solr/commit/5795edd143b8fcb2ffaf7f278a099b8678adf396","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/SOLR-17543","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4p5m-gvpf-f3x5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52012.json","tags":["advisory"]},{"url":"https://github.com/apache/solr","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-52012","title":"Apache Solr: Configset upload on Windows allows arbitrary path write-access","description":"Relative Path Traversal vulnerability in Apache Solr.\n\nSolr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the \"configset upload\" API.  Commonly known as a \"zipslip\", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.  \nThis issue affects Apache Solr: from 6.6 through 9.7.0.\n\nUsers are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's \"Rule-Based Authentication Plugin\" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.","status":"published","published":"2025-01-27T08:54:42.907Z","modified":"2025-02-06T16:11:37.353Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:34:03.661584Z"}],"euvd":[{"id":"EUVD-2025-0133","description":"Relative Path Traversal vulnerability in Apache Solr.\n\nSolr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the \"configset upload\" API.  Commonly known as a \"zipslip\", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.  \nThis issue affects Apache Solr: from 6.6 through 9.7.0.\n\nUsers are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's \"Rule-Based Authentication Plugin\" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.","status":"published","published":"2025-01-27T08:54:42Z","modified":"2025-02-06T16:11:37Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:03.312509Z"}],"ghsa":[{"id":"GHSA-4p5m-gvpf-f3x5","title":"Apache Solr Relative Path Traversal vulnerability","description":"Relative Path Traversal vulnerability in Apache Solr.\n\nSolr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the \"configset upload\" API.  Commonly known as a \"zipslip\", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.  \nThis issue affects Apache Solr: from 6.6 through 9.7.0.\n\nUsers are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's \"Rule-Based Authentication Plugin\" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.","status":"published","published":"2025-01-27T09:30:35Z","modified":"2025-01-27T17:22:44Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:38:28.945236Z"}],"nvd":[{"id":"CVE-2024-52012","description":"Relative Path Traversal vulnerability in Apache Solr.\n\nSolr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the \"configset upload\" API.  Commonly known as a \"zipslip\", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.  \nThis issue affects Apache Solr: from 6.6 through 9.7.0.\n\nUsers are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's \"Rule-Based Authentication Plugin\" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.","status":"published","published":"2025-01-27T09:15:14.693Z","modified":"2026-06-17T08:06:48.06Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:10:43.581383Z"}],"osv":[{"id":"CVE-2024-52012","title":"Apache Solr: Configset upload on Windows allows arbitrary path write-access","description":"Relative Path Traversal vulnerability in Apache Solr.\n\nSolr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the \"configset upload\" API.  Commonly known as a \"zipslip\", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.  \nThis issue affects Apache Solr: from 6.6 through 9.7.0.\n\nUsers are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's \"Rule-Based Authentication Plugin\" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.","status":"published","published":"2025-01-27T08:54:42.907Z","modified":"2026-10-28T10:54:41.427532406Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"GHSA-4p5m-gvpf-f3x5","title":"Apache Solr Relative Path Traversal vulnerability","description":"Relative Path Traversal vulnerability in Apache Solr.\n\nSolr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the \"configset upload\" API.  Commonly known as a \"zipslip\", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.  \nThis issue affects Apache Solr: from 6.6 through 9.7.0.\n\nUsers are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's \"Rule-Based Authentication Plugin\" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.","status":"published","published":"2025-01-27T09:30:35Z","modified":"2026-09-10T03:50:56.351285543Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"BIT-solr-2024-52012","title":"Apache Solr: Configset upload on Windows allows arbitrary path write-access","description":"Relative Path Traversal vulnerability in Apache Solr.\n\nSolr instances running on Windows are vulnerable to arbitrary filepath write-access, due to a lack of input-sanitation in the \"configset upload\" API.  Commonly known as a \"zipslip\", maliciously constructed ZIP files can use relative filepaths to write data to unanticipated parts of the filesystem.  \nThis issue affects Apache Solr: from 6.6 through 9.7.0.\n\nUsers are recommended to upgrade to version 9.8.0, which fixes the issue.  Users unable to upgrade may also safely prevent the issue by using Solr's \"Rule-Based Authentication Plugin\" to restrict access to the configset upload API, so that it can only be accessed by a trusted set of administrators/users.","status":"published","published":"2025-01-29T07:20:30.008Z","modified":"2026-09-08T08:48:19.34506954Z","updated_at":"2026-11-02T15:28:35.111822Z"}]}}