CVE-2024-3584: Qdrant Path Traversal Vulnerability

CVE-2024-3584 Overview

CVE-2024-3584 is a path traversal vulnerability in the Qdrant vector database, affecting version 1.9.0-dev. The flaw resides in the /collections/{name}/snapshots/upload endpoint, which fails to properly validate the name path parameter. An attacker can manipulate the parameter using URL encoding to escape the intended directory and write files to arbitrary locations on the host filesystem, such as /root/poc.txt. Successful exploitation enables arbitrary file write and overwrite, which can escalate to full system compromise. The issue is tracked under [CWE-20] (Improper Input Validation) and is fixed in Qdrant 1.9.0.

Critical Impact
Unauthenticated attackers can write or overwrite arbitrary files on the Qdrant server, enabling code execution and full host takeover.

Affected Products

Qdrant 1.9.0-dev
Qdrant vector database deployments exposing the snapshot upload API
Self-hosted Qdrant instances prior to version 1.9.0

Discovery Timeline

2024-05-30 - CVE-2024-3584 published to NVD
2025-07-10 - Last updated in NVD database

Technical Details for CVE-2024-3584

Vulnerability Analysis

Qdrant is an open-source vector similarity search engine used in AI and machine learning pipelines. The snapshot upload endpoint accepts a collection name parameter from the URL and uses it to construct a server-side file path for the uploaded snapshot. The handler does not enforce a strict schema on this parameter and accepts URL-encoded traversal sequences such as %2F..%2F..%2F. As a result, the decoded path resolves outside the intended snapshots directory.

Because the endpoint requires no authentication in default deployments, a remote attacker can submit a crafted multipart upload that writes the request body to any path the Qdrant process can access. Overwriting binaries, configuration files, SSH authorized_keys, or cron jobs leads directly to remote code execution. The integrity-only CVSS profile reflects the arbitrary write primitive without direct data confidentiality loss.

Root Cause

The root cause is improper validation of the collection name when constructing the snapshot destination path. The handler used a CollectionPath extractor that did not reject traversal characters. The fix introduces a StrictCollectionPath extractor that constrains the name to a safe character set, preventing path manipulation.

Attack Vector

Exploitation requires only network access to the Qdrant HTTP API. An attacker issues a POST request to /collections/{name}/snapshots/upload where {name} contains URL-encoded ../ sequences. The server decodes the parameter, joins it to the snapshots base directory, and writes the uploaded file to the resolved location.

rust

 use uuid::Uuid;
 use validator::Validate;
 
-use super::CollectionPath;
+use super::{CollectionPath, StrictCollectionPath};
 use crate::actix::auth::ActixAccess;
 use crate::actix::helpers::{self, process_response, HttpError};
 use crate::common;

Source: Qdrant GitHub Commit 15479a4. The patch swaps the permissive CollectionPath extractor for StrictCollectionPath on the snapshot upload route, blocking traversal payloads at the request parsing layer.

Detection Methods for CVE-2024-3584

Indicators of Compromise

HTTP requests to /collections/*/snapshots/upload containing URL-encoded traversal sequences such as %2e%2e%2f, %2F.., or ..%2F.
Unexpected files appearing outside the configured Qdrant snapshots directory, particularly in /root, /etc, /var/spool/cron, or user home directories.
Qdrant process writes to filesystem locations not normally touched by the service, observable in audit logs or auditd rules.

Detection Strategies

Inspect Qdrant access logs and reverse-proxy logs for POST requests to the snapshot upload endpoint with non-alphanumeric collection names.
Apply WAF rules that decode the request URI and reject snapshot upload paths containing .. segments after normalization.
Compare the running Qdrant version against 1.9.0 to flag vulnerable deployments during asset discovery.

Monitoring Recommendations

Enable filesystem integrity monitoring on directories outside the configured snapshot path used by the Qdrant service account.
Alert on any Qdrant child process or shell invocation, which is anomalous for the vector database runtime.
Forward Qdrant and reverse-proxy logs to a centralized SIEM for correlation of upload requests with subsequent filesystem changes.

How to Mitigate CVE-2024-3584

Immediate Actions Required

Upgrade all Qdrant instances to version 1.9.0 or later, which includes the StrictCollectionPath fix.
Restrict network exposure of the Qdrant API to trusted clients only, using firewalls or service mesh policies.
Place Qdrant behind an authenticating reverse proxy and enable the API key feature in config.yaml.
Audit the Qdrant host for files written outside the snapshots directory since the service was first exposed.

Patch Information

The vulnerability is fixed in Qdrant 1.9.0. The remediation commit replaces the path extractor on the snapshot upload route with StrictCollectionPath, which validates collection names against a restricted character set. Review the Qdrant security commit and the Huntr bounty disclosure for full technical context.

Workarounds

Block requests to /collections/*/snapshots/upload at the reverse proxy until the upgrade is applied.
Run the Qdrant process as an unprivileged user with a read-only root filesystem, limiting the blast radius of arbitrary writes.
Enforce request URI normalization and reject traversal sequences at the ingress layer.

bash

# Example NGINX rule to block snapshot upload until patched
location ~ ^/collections/.*/snapshots/upload$ {
    return 403;
}