{"data":{"id":"5172a3b3-95ab-41e5-8409-d98cd6634129","title":"CVE-2026-25628: Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append…","summary":"CVE-2026-25628 affects Qdrant, a vector similarity search engine and vector database, in versions from 1.9.3 up to but not including 1.16.0. An attacker with read-only access can append to arbitrary files through the /logger endpoint by supplying a controlled on_disk.log_file path. The weakness is classified as CWE-73, External Control of File Name or Path.","solution":"Fixed in 1.16.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25628","publishedAt":"2026-02-07T02:16:18.083Z","cveId":"CVE-2026-25628","cweIds":["CWE-73"],"cvssScore":"8.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["qdrant@>= 1.9.3, < 1.15.6 (fixed: 1.15.6)"],"affectedPackageNames":["qdrant"],"affectedPackageRefs":["cargo:qdrant"],"affectedVendors":[],"affectedVendorsRaw":["Qdrant"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Qdrant arbitrary file append via /logger endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00543,"epssCheckedAt":"2026-11-04T06:10:14.970Z","kevDateAdded":null,"advisoryAliases":["GHSA-f632-vm87-2m2f"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:58.017Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:41:42.100Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"cargo","name":"qdrant","fixedVersion":"1.15.6","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":"registry","status":"version_not_found","checkedAt":"2026-10-29T21:41:41.934Z"}]}}