Description
qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By manipulating the `name` parameter through URL encoding, an attacker can upload a file to an arbitrary location on the system, such as `/root/poc.txt`. This vulnerability allows for the writing and overwriting of arbitrary files on the server, potentially leading to a full takeover of the system. The issue is fixed in version 1.9.0.
References (2)
Core 2
Core References
Exploit, Third Party Advisory
https://huntr.com/bounties/5c7c82e2-4873-40b7-a5f3-0f4a42642f73
Scores
CVSS v3
7.5
EPSS
0.0039
EPSS Percentile
59.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-20
Status
published
Products (2)
crates.io/qdrant
1.9.0-dev - 1.9.0crates.io
qdrant/qdrant
< 1.9.0
Published
May 30, 2024
Tracked Since
Feb 18, 2026