CVE-2025-24814

Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "<lib>" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.

This issue affects all Apache Solr versions up through Solr 9.7. Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from "FileSystemConfigSetService"). Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of "<lib>" tags by default.

References

Affected packages

Git / github.com/apache/solr

Affected ranges

Type

GIT

Repo

https://github.com/apache/solr

Events

Introduced

Fixed

8bf0100e502ade4b8161e4b90f762b117a6ef442

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.8.0"
        }
    ]
}

Affected versions

Other

grafts/lucene-oldest

grafts/lucene-solr-copy

grafts/lucene-solr-oldest-merged

history/branches/lucene-solr/branch_7

history/branches/lucene-solr/lucene-6997

history/branches/lucene-solr/lucene/main

history/branches/lucene-solr/origin/branch_8_x

history/branches/lucene-solr/pointvalues

history/branches/lucene-solr/solr/main

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-24814.json"