Description
Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append to arbitrary files via /logger endpoint using an attacker-controlled on_disk.log_file path. Minimal privileges are required (read-only access). This vulnerability is fixed in 1.16.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| qdrant | qdrant | >= 1.9.3, < 1.16.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | qdrant | >= 1.9.3, < 1.15.6 | 1.15.6 | GHSA-f632-vm87-2m2f |