Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M
CVE-2026-25628Qdrant affected by arbitrary file write via `/logger` endpoint
High 8.6
In plain English
A high-severity security flaw in qdrant from qdrant. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.5%top 54.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append to arbitrary files via /logger endpoint using an attacker-controlled on_disk.log_file path. Minimal privileges are required (read-only access). This vulnerability is fixed in 1.16.0.
Affected products (as reported)
Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/qdrant/qdrant/security/advisories/GHSA-f632-vm87-2m2f x_refsource_CONFIRM
- https://github.com/qdrant/qdrant/commit/32b7fdfb7f542624ecd1f7c8d3e2b13c4e36a2c1 x_refsource_MISC
- https://github.com/qdrant/qdrant/blob/48203e414e4e7f639a6d394fb6e4df695f808e51/src/actix/api/service_api.rs#L195 x_refsource_MISC