VYPR
← All advisories
High severity8.5NVD Advisory· Published Feb 6, 2026· Updated Jun 17, 2026

CVE-2026-25628

CVE-2026-25628

Description

Qdrant is a vector similarity search engine and vector database. From 1.9.3 to before 1.16.0, it is possible to append to arbitrary files via /logger endpoint using an attacker-controlled on_disk.log_file path. Minimal privileges are required (read-only access). This vulnerability is fixed in 1.16.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
qdrantcrates.io
>= 1.9.3, < 1.15.61.15.6

Affected products

3
  • Qdrant/Qdrant2 versions
    cpe:2.3:a:qdrant:qdrant:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:qdrant:qdrant:*:*:*:*:*:*:*:*range: >=1.9.3,<=1.16.0
    • (no CPE)range: >= 1.9.3, < 1.16.0
  • ghsa-coords
    pkg:cargo/qdrant
    Range: >= 1.9.3, < 1.15.6

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.