Description
Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the solr user can access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Solr | Prior to 8.6.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lucene-solr | 3.6.2+dfsg-23 | — |
| Debian 13 | lucene-solr | 3.6.2+dfsg-23 | — |
| Debian 12 | lucene-solr | 3.6.2+dfsg-23 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | lucene-solr | No fix yet | — |
| Ubuntu 26.04 LTS | lucene-solr | No fix yet | — |
| Ubuntu 25.10 | lucene-solr | No fix yet | — |
| Ubuntu 24.04 LTS | lucene-solr | No fix yet | — |
| Ubuntu 22.04 LTS | lucene-solr | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | lucene-solr | No fix yet | — |
| Ubuntu Pro 18.04 LTS | lucene-solr | No fix yet | — |
| Ubuntu Pro 16.04 LTS | lucene-solr | No fix yet | — |
| Ubuntu Pro 14.04 LTS | lucene-solr | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
mbadanoiu/CVE-2020-13941 ★ 0 · Apr 14, 2025
CVE-2020-13941: Abusing UNC Paths in Windows Environments in Apache Solr
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.solr:solr-parent | < 8.6.0 | 8.6.0 | GHSA-2467-h365-j7hm |
References
- https://lists.apache.org/thread.html/rf54e7912b7d2b72c63ec54a7afa4adcbf16268dcc63253767dd67d60%40%3Cgeneral.lucene.apache.org%3E
- [lucene-commits] 20200912 [lucene-site] 01/01: Solr CVE-2020-13941 (#29) mailing-list
- [submarine-commits] 20201209 [GitHub] [submarine] QiAnXinCodeSafe opened a new issue #474: There is a vulnerability in Apache Solr 5.5.4,upgrade recommended mailing-list
- [druid-commits] 20210324 [GitHub] [druid] jihoonson opened a new pull request #11030: Suppress cves mailing-list