Read the docs
TI-2024-03573 Aliases CVE-2024-3829GHSA-7m75-x27w-r52r

Arbitrary File Read and Write during Snapshot Recovery in qdrant/qdrant

Priority HIGH 80CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the filesystem and arbitrary file write by including a symlink and a payload file in the snapshot's directory structure. This vulnerability allows for the reading and writing of arbitrary files on the server, which could potentially lead to a full takeover of the system. The issue is fixed in version v1.9.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00909 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed qdrant/qdrant (qdrant): v1.9.0qdrant-client (PyPI): 1.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
qdrantqdrant/qdrantbefore v1.9.0v1.9.0Patch availableCNA
—qdrant-client (PyPI)before 1.9.01.9.0Patch availableGHSA-7m75-x27w-r52r
  • qdrant/qdrant Vendorqdrant Affected before v1.9.0 Fixed in v1.9.0 Patch available CNA
  • qdrant-client (PyPI) Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available GHSA-7m75-x27w-r52r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:qdrant:qdrant:*:*:*:*:*:*:*:*before 1.9.0Vulnerableqdrant
  • cpe:2.3:a:qdrant:qdrant:*:*:*:*:*:*:*:* Versions before 1.9.0 Vulnerable ·qdrant

Remediation

  • Fix · CNA qdrant/qdrant (qdrant) Fixed in v1.9.0
  • Fix · GHSA-7m75-x27w-r52r qdrant-client (PyPI) Fixed in 1.9.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3829
  2. 2026-10-03 Alias added: GHSA-7m75-x27w-r52r

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2024-02062 Path Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrant CVSS 3.0CRITICAL 9.8
  • TI-2024-03341 Path Traversal in qdrant/qdrant CVSS 3.1HIGH 7.5
  • TI-2026-20730 Qdrant affected by arbitrary file write via `/logger` endpoint CVSS 3.1HIGH 8.8
  • TI-2023-20226 * Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker cause a denial… CVSS 3.1HIGH 7.5
  • TI-2024-02883 Qdrant Full Snapshot REST API snapshots.rs path traversal CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences