CVE-2024-3584

qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By manipulating the `name` parameter through URL encoding, an attacker can upload a file to an arbitrary location on the system, such as `/root/poc.txt`. This vulnerability allows for the writing and overwriting of arbitrary files on the server, potentially leading to a full takeover of the system. The issue is fixed in version 1.9.0.

• CWE-20

• https://github.com/qdrant/qdrant/commit/15479a45ffa3b955485ae516696f7e933a8cce8aPatch
• https://huntr.com/bounties/5c7c82e2-4873-40b7-a5f3-0f4a42642f73Exploit, Third Party Advisory
• https://github.com/qdrant/qdrant/commit/15479a45ffa3b955485ae516696f7e933a8cce8aPatch
• https://huntr.com/bounties/5c7c82e2-4873-40b7-a5f3-0f4a42642f73Exploit, Third Party Advisory

Published

May 30, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-35834In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-35835In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-35836In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-35837In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-35838In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-35839In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-35840In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-35841In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-35842In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-35843In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2024-35844In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-35845In the Linux kernel, the following vulnerability has been re…9.1