{"id":"CVE-2015-5531","published":"2015-08-17T15:00:00Z","modified":"2024-08-06T06:50:02Z","title":"Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a directory traversal vulnerability in Elasticsearch versions before 1.6.1, located in the handling of snapshot API calls. An attacker who can reach the affected service over the network can read arbitrary files on the host through unspecified request vectors.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:15:21Z"},"cvss":null,"epss":{"score":0.94788,"percentile":0.99858,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-05-27","exploitedFirstSeen":"2025-05-27","ransomware":false,"evidence":[{"url":"https://www.greynoise.io/blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-points","date":"2025-05-27"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day","url":"https://otx.alienvault.com/pulse/68404f73e208ff30c97ed2a4","created":"2025-06-04"},{"name":"Cloud-Based Scanning Campaign Targeting 75+ Exposure Points","url":"https://otx.alienvault.com/pulse/6837cb935326caff09e2725e","created":"2025-05-29"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/archive/1/536017/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/133964/ElasticSearch-Snapshot-API-Directory-Traversal.html","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/75935","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://packetstormsecurity.com/files/133797/ElasticSearch-Path-Traversal-Arbitrary-File-Download.html","tags":["x_refsource_MISC"]},{"url":"https://www.elastic.co/community/security/","tags":["x_refsource_CONFIRM"]},{"url":"https://www.exploit-db.com/exploits/38383/","tags":["exploit","x_refsource_EXPLOIT-DB"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.elasticsearch:elasticsearch","vulnerableRanges":["<1.6.1"],"patched":["1.6.1"],"from":["GHSA-jjq8-vfjq-j6v4"],"provenance":"source"}],"advisories":[{"id":"GHSA-jjq8-vfjq-j6v4","url":"https://github.com/advisories/GHSA-jjq8-vfjq-j6v4","severity":"MODERATE","ecosystem":"Maven","package":"org.elasticsearch:elasticsearch","vulnerableRanges":["<1.6.1"],"patched":["1.6.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-4392","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4392","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":38383,"url":"https://www.exploit-db.com/exploits/38383","title":"ElasticSearch 1.6.0 - Arbitrary File Download","type":"webapps","platform":"linux","date":"2015-10-02","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2015-10-02"},"pocGithub":{"count":1,"skipped":1,"earliest":"2022-09-21","earliestUrl":"https://github.com/MoCh3n/CVE-2015-5531-POC","repos":[{"name":"MoCh3n/CVE-2015-5531-POC","url":"https://github.com/MoCh3n/CVE-2015-5531-POC","stars":2,"created":"2022-09-21"}]},"metasploit":[{"name":"ElasticSearch Snapshot API Directory Traversal","module":"auxiliary/scanner/http/elasticsearch_traversal","type":"auxiliary","disclosureDate":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_traversal.rb"}],"nuclei":[{"id":"CVE-2015-5531","name":"ElasticSearch <1.6.1 - Local File Inclusion","severity":"medium","path":"http/cves/2015/CVE-2015-5531.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5531.yaml"}],"first":{"date":"2015-10-02","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/38383"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/38383/","http://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html","http://packetstormsecurity.com/files/133964/ElasticSearch-Snapshot-API-Directory-Traversal.html","http://packetstormsecurity.com/files/133797/ElasticSearch-Path-Traversal-Arbitrary-File-Download.html","https://www.exploit-db.com/exploits/38383"],"flow":[],"timeline":[{"date":"2015-08-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2015-5531","provenance":"source"},{"date":"2015-10-02","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-38383); later: PoC-in-GitHub 2022-09-21","url":"https://www.exploit-db.com/exploits/38383","provenance":"source"},{"date":"2025-05-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.greynoise.io/blog/coordinated-cloud-based-scanning-operation-targets-75-known-exposure-points","provenance":"source"}],"speed":{"daysToPublicExploit":46,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":61.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 520 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9986"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 3 NVD exploit links; 1 advisory exploit reference; 1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}