CVE-2024-3078

A vulnerability was found in Qdrant up to 1.6.1/1.7.4/1.8.2 and classified as critical. This issue affects some unknown processing of the file lib/collection/src/collection/snapshots.rs of the component Full Snapshot REST API. The manipulation leads to path traversal. Upgrading to version 1.8.3 is able to address this issue. The patch is named 3ab5172e9c8f14fa1f7b24e7147eac74e2412b62. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-258611.

• CWE-22

• https://github.com/qdrant/qdrant/commit/3ab5172e9c8f14fa1f7b24e7147eac74e2412b62Patch
• https://github.com/qdrant/qdrant/pull/3856Issue Tracking, Patch
• https://github.com/qdrant/qdrant/releases/tag/v1.8.3Release Notes
• https://vuldb.com/?ctiid.258611Permissions Required, VDB Entry
• https://vuldb.com/?id.258611Third Party Advisory, VDB Entry
• https://github.com/qdrant/qdrant/commit/3ab5172e9c8f14fa1f7b24e7147eac74e2412b62Patch
• https://github.com/qdrant/qdrant/pull/3856Issue Tracking, Patch
• https://github.com/qdrant/qdrant/releases/tag/v1.8.3Release Notes
• https://vuldb.com/?ctiid.258611Permissions Required, VDB Entry
• https://vuldb.com/?id.258611Third Party Advisory, VDB Entry

Published

Mar 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-30736Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-30737Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-3074The Elementor ImageBox plugin for WordPress is vulnerable to…6.4
• CVE-2024-3075The MM-email2image WordPress plugin through 0.2.5 does not v…8.1
• CVE-2024-3076The MM-email2image WordPress plugin through 0.2.5 does not h…3.8
• CVE-2024-3077An malicious BLE device can crash BLE victim device by sendi…6.5
• CVE-2024-3079Certain models of ASUS routers have buffer overflow vulnerab…7.2
• CVE-2024-30799An issue in PX4 Autopilot v1.14 and before allows a remote a…4.4
• CVE-2024-3080Certain ASUS router models have authentication bypass vulner…9.8
• CVE-2024-30800PX4 Autopilot v.1.14 allows an attacker to fly the drone int…5.6
• CVE-2024-30801SQL Injection vulnerability in Cloud based customer service …5.5
• CVE-2024-30802An issue in Vehicle Management System 7.31.0.3_20230412 allo…9.8