{"data":{"id":"34e089c6-e2c1-42e8-8969-39a8dd75813d","title":"CVE-2024-2221: qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the…","summary":"CVE-2024-2221 affects qdrant/qdrant. The /collections/{COLLECTION}/snapshots/upload endpoint is vulnerable to path traversal and arbitrary file upload through the snapshot parameter. An attacker can upload and overwrite any file on the filesystem, which the source says could lead to remote code execution and unauthorized access.","solution":"Patch: https://github.com/qdrant/qdrant/commit/e6411907f0ecf3c2f8ba44ab704b9e4597d9705d","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-2221","publishedAt":"2024-04-10T21:15:54.633Z","cveId":"CVE-2024-2221","cweIds":["CWE-434","CWE-22","CWE-434"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Qdrant"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"qdrant/qdrant path traversal and arbitrary file upload via snapshot","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01845,"epssCheckedAt":"2026-11-04T06:10:13.820Z","kevDateAdded":null,"advisoryAliases":["GHSA-hm95-xqg2-4w57"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-29T06:09:50.179Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-1","CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}