CVE-2026-25628 Qdrant affected by arbitrary file write via `/logger` endpoint
An attacker with read-only access can append data to arbitrary files on the server via the /logger endpoint in Qdrant.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25628?
CVE-2026-25628 is a high-severity path traversal vulnerability in qdrant, published on 6 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append to arbitrary files via /logger endpoint using an attacker-controlled on_disk.log_file path. Minimal privileges are required (read-only access). This vulnerability is fixed in 1.16.0.
Weakness: CWE-73
Which versions are affected by CVE-2026-25628?
2 open source packages ship an affected version, including qdrant. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
qdrant crates.io | From 1.9.3 | 1.15.6 |
qdrant crates.io | From 1.9.3 | 1.15.6 |
Products include Qdrant Qdrant.
How do I fix CVE-2026-25628?
Upgrade qdrant to 1.15.6 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-25628 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25628 exists.
Other vulnerabilities in qdrant
- CVE-2024-3829 Arbitrary File Read and Write during Snapshot Recovery in qdrant/qdrant
- CVE-2024-3584 Path Traversal in qdrant/qdrant
- CVE-2024-2221 Path Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrant
- CVE-2023-38975 Memory corruption in n/a
- CVE-2024-3078 Qdrant Full Snapshot REST API snapshots.rs path traversal
Sources
Also known as GHSA-f632-vm87-2m2f.