CVE-2024-2221

NONE EPSS 76.4%
Published Apr 10, 20242y ago · Modified Jun 17, 20262w ago
Find Similar
Published Apr 10, 2024 2y ago
Last Modified Jun 17, 2026 2w ago

Description

qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the `/collections/{COLLECTION}/snapshots/upload` endpoint, specifically through the `snapshot` parameter. This vulnerability allows attackers to upload and overwrite any file on the filesystem, leading to potential remote code execution. This issue affects the integrity and availability of the system, enabling unauthorized access and potentially causing the server to malfunction.

Threat Intelligence

EPSS Exploit Probability
76.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-22 Path Traversal Resource Mgmt
CWE-434 Unrestricted Upload of File with Dangerous Type Resource Mgmt

Affected Products 1

VendorProductVersionRange
qdrantqdrant1.7.4any

References 2

  • github.com https://github.com/qdrant/qdrant/commit/e6411907f0ecf3c2f8ba44ab704b9e4597d9705d
    Patch
  • huntr.com https://huntr.com/bounties/6be8d4e3-67e6-4660-a8db-04215a1cff3e
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/qdrant/qdrant/commit/e6411907f0ecf3c2f8ba44ab704b9e4597d9705d
    Patch