Report feedback

Allows an unauthenticated remote attacker, when creating a Solr core on instances using "FileSystemConfigSetService" (the default in "standalone" or "user-managed" modes) without active authentication and authorization, to bypass "trusted" configuration files and load any others available in the file system. These may contain <lib> tags and could potentially be used to load code such as a SearchComponent or another plugin [1]. If it is not possible to update to a fixed version, which disables <lib> tags by default, it is recommended to enable authentication and authorization or to switch to SolrCloud, which does not use "FileSystemConfigSetService" [1][2].

The vulnerability is present in product:

• *:Apache Solr;<=9.7

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

More information:

• CVE-2025-24814 at cve.org, NVD
• CWE-250: Execution with Unnecessary Privileges at cwe.mitre.org

The vulnerability was publicly disclosed 26. 1. 2025.

Allows an authenticated remote attacker, due to insufficient input validation in the configset upload API on Windows instances, to write data outside the designated file system location using specially crafted ZIP files [3][4]. If updating to a fixed version is not possible, it is recommended to use the Rule-Based Authentication Plugin to restrict access to the API to trusted administrators and users only [3][4].

The vulnerability is present in product:

• Windows:Apache Solr;>=6.6,<=9.7.0

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

More information:

• CVE-2024-52012 at cve.org, NVD
• CWE-23: Relative Path Traversal at cwe.mitre.org

The vulnerability was publicly disclosed 26. 1. 2025.