CVE-2024-3829 Arbitrary File Read and Write during Snapshot Recovery in qdrant/qdrant
Attackers can read or write arbitrary files on the server by manipulating symlinks in snapshot recovery, potentially leading to system takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-3829?
CVE-2024-3829 is a critical path traversal vulnerability in qdrant/qdrant, published on 3 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
qdrant/qdrant version 1.9.0-dev is vulnerable to arbitrary file read and write during the snapshot recovery process. Attackers can exploit this vulnerability by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the filesystem and arbitrary file write by including a symlink and a payload file in the snapshot's directory structure. This vulnerability allows for the reading and writing of arbitrary files on the server, which could potentially lead to a full takeover of the system. The issue is fixed in version v1.9.0.
Weakness: CWE-59
Which versions are affected by CVE-2024-3829?
3 open source packages ship an affected version, including qdrant-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
qdrant-client PyPI | All versions | 1.9.0 |
qdrant-client PyPI | All versions | 1.9.0 |
qdrant-client PyPI | All versions | 1.9.0 |
Products include Qdrant Qdrant.
How do I fix CVE-2024-3829?
Upgrade qdrant-client to 1.9.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-3829 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-3829 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in qdrant/qdrant
- CVE-2024-3584 Path Traversal in qdrant/qdrant
- CVE-2024-2221 Path Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrant
- CVE-2026-25628 Qdrant affected by arbitrary file write via `/logger` endpoint
- CVE-2023-38975 Memory corruption in n/a
- CVE-2024-3078 Qdrant Full Snapshot REST API snapshots.rs path traversal
Sources
Also known as GHSA-7m75-x27w-r52r, PYSEC-2026-509.