8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25628

CVE-2026-25628: Qdrant affected by arbitrary file write via `/logger` endpoint

Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append to arbitrary files via /logger endpoint using an attacker-controlled on_disk.log_file path. Minimal privileges are required (read-only access). This vulnerability is fixed in 1.16.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25628

CVE-2026-25628:

8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
qdrant	rust	>= 1.9.3, < 1.15.6	1.15.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described allows an attacker with low privileges to write to arbitrary files through the /logger endpoint by specifying a malicious on_disk.log_file path. The analysis of the provided patch commit 32b7fdfb7f542624ecd1f7c8d3e2b13c4e36a2c1 confirms this. The patch modifies the update_logger_config function in src/actix/api/service_api.rs. Before the patch, this function took the logger configuration directly from the user's request and applied it. The patch introduces two key changes: first, it adds an authorization check (access.check_global_access(AccessRequirements::new().manage())?) to ensure only users with management privileges can access this endpoint. Second, it explicitly nullifies the log_file path from the user's input (config.on_disk.log_file = None;), preventing attackers from controlling the log file's destination. This directly mitigates the reported arbitrary file write vulnerability. Therefore, the update_logger_config function is the vulnerable function as it was the entry point for processing the malicious input.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.