Improper Input Validation Affecting qdrant-client package, versions [,1.9.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-QDRANTCLIENT-7210306
- published 5 Jun 2024
- disclosed 3 Jun 2024
- credit ozelis
How to fix?
Upgrade qdrant-client to version 1.9.0 or higher.
Overview
qdrant-client is a Client library for the Qdrant vector search engine
Affected versions of this package are vulnerable to Improper Input Validation through the snapshot recovery process. An attacker can read and write arbitrary files on the server by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the filesystem and arbitrary file write by including a symlink and a payload file in the snapshot's directory structure. This vulnerability allows for the reading and writing of arbitrary files on the server, which could potentially lead to a full takeover of the system.