-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing symlink validation during tar archive extraction in snapshot recovery. The pre-patch code in these functions used basic tar unpacking (Archive::new(file).unpack()) without checking entry types. Attackers could include symlinks in snapshots to write/read arbitrary files. The fix introduced validate_open_snapshot_archive which iterates through tar entries and rejects non-regular-file/non-directory entries (like symlinks). The vulnerable functions are those that handled snapshot restoration without this validation step, as seen in the diff adding validation wrappers around Archive::new calls.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| qdrant-client | pip | < 1.9.0 | 1.9.0 |