Description
When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Solr | 1.4.0 to 5.5.3, 6.0.0 to 6.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lucene-solr | 3.6.2+dfsg-11 | — |
| Debian 13 | lucene-solr | 3.6.2+dfsg-11 | — |
| Debian 12 | lucene-solr | 3.6.2+dfsg-11 | — |
| Debian 9 | lucene-solr | 3.6.2+dfsg-10+deb9u1 | DSA-4124-1 |
| Debian 8 | lucene-solr | 3.6.2+dfsg-5+deb8u1 | DSA-4124-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | lucene-solr | 3.6.0+dfsg-1+deb7u2 | DLA-1046-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | lucene-solr | No fix yet | — |
| Ubuntu Pro 14.04 LTS | lucene-solr | 3.6.2+dfsg-2ubuntu0.1~esm2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 6 | codehaus-jackson +4 | 1.9.9-12.redhat_6.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-26.SP24_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | jboss-as-ee +62 | 7.5.20-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.20-1.Final_redhat_1.ep6.el6 | RHSA-2018:1451 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.43-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.28-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | jgroups | 1:3.2.18-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | lucene-solr | 3.6.2-8.redhat_9.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | picketbox | 4.1.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.solr:solr-core | < 5.5.4 | 5.5.4 | GHSA-387v-84cv-9qmc |
| Maven | org.apache.solr:solr-core | >= 6.0.0, < 6.4.1 | 6.4.1 | GHSA-387v-84cv-9qmc |
Advisories 6
- RHSA-2018:1451 Red Hat Security Advisory: eap6-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1450 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1448 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1449 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- DSA-4124-1 lucene-solr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1046-1 lucene-solr - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2018:1448 vendor-advisory
- RHSA-2018:1449 vendor-advisory
- RHSA-2018:1450 vendor-advisory
- RHSA-2018:1451 vendor-advisory
- [solr-user] 20170215 [SECURITY] CVE-2017-3163 Apache Solr ReplicationHandler path traversal attack mailing-list
- RHSA-2018:1447 vendor-advisory
- DSA-4124 vendor-advisory