PatchTheCVECVE-2025-24814: Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances t
CVE-2025-24814 is a medium-severity flaw (CVSS 5.5) affecting solr. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available else
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 1.2% (top 33%) |
| CISA exploited list | No |
| Weakness | CWE-250 |
| Published | 2025-01-27 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-24814?
solr: upgrade to 9.8.0. Exact commands for each OS are on this page.
Is CVE-2025-24814 being exploited?
CVE-2025-24814 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-24814 affect?
CVE-2025-24814 affects solr. Severity is medium (CVSS 5.5). Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running w
How urgent is CVE-2025-24814?
Priority 41/100. On your watchlist
Software pages
Related CVEs
- CVE-2026-44825 HIGH 8.1 UPGRADE Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.
- CVE-2026-22444 HIGH 7.1 UPGRADE The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API paramete
- CVE-2026-22022 HIGH 8.2 UPGRADE Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vuln
- CVE-2024-52012 MEDIUM 5.4 UPGRADE Relative Path Traversal vulnerability in Apache Solr. Solr instances running on Windows are vulnerable to arb
- CVE-2024-45217 HIGH 8.1 UPGRADE Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via