Critical
Security advisory
A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-42767
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:38 UTC · Revision 1
Source evidence
A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.
osv:CVE-2021-42767
Complete source record
{
"id": "e400c30422afae7857731e7bffd712d36a29408dd7470d09f3ed0842b0cb19bf",
"url": "https://osv.dev/vulnerability/CVE-2021-42767",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-42767",
"summary": "A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.",
"evidence": "osv:CVE-2021-42767",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2021-42767",
"aliases": [
"CVE-2021-42767",
"GHSA-4mpj-488r-vh6m"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/neo4j-contrib/neo4j-apoc-procedures",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "88902b4b31f258dc9a7371dd7287b13e48c5d46a"
},
{
"introduced": "93927b89028f67503ce8593c1509db598d102165"
},
{
"fixed": "52a0958220ed2998225bce4548636a037ed9d16a"
},
{
"introduced": "1e6de8e88876b526f84b677e4e6859f6f5b27c95"
},
{
"fixed": "adee61eeef8711c0f498f3e9762d542aa2f96d8c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:neo4j:awesome_procedures:*:*:*:*:*:neo4j:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.5.0.17"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:neo4j:awesome_procedures:*:*:*:*:*:neo4j:*:*",
"range": [
{
"introduced": "4.3.0.0"
},
{
"fixed": "4.3.0.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:neo4j:awesome_procedures:*:*:*:*:*:neo4j:*:*",
"range": [
{
"introduced": "4.4.0.0"
},
{
"fixed": "4.4.0.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"3.5.0.16",
"3.5.0.15-fix",
"4.4.0.0",
"4.3.0.3",
"4.3.0.2",
"4.3.0.1",
"4.3.0.0",
"3.5.0.15",
"3.5.0.14",
"3.5.0.13",
"3.5.0.12",
"3.5.0.11",
"3.5.0.9",
"3.5.0.8",
"3.5.0.7",
"3.5.0.6",
"3.5.0.5",
"3.5.0.4",
"3.5.0.3",
"3.5.0.2",
"3.5.0.1",
"3.5.0.0",
"3.4.0.3",
"3.4.0.2",
"3.4.0.1",
"3.3.0.2",
"3.3.0.1",
"3.2.0.4",
"3.2.0.3",
"3.1.3.6",
"3.1.2.5",
"3.1.0.4",
"3.1.0.3",
"3.1.0.2",
"3.1.0.1",
"3.0.4.1",
"1.1.0",
"1.0.0",
"1.0.0-RC1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-42767.json",
"vanir_signatures": [
{
"id": "CVE-2021-42767-1dfd6a10",
"digest": {
"length": 891,
"function_hash": "207802441921537204896901189403421172352"
},
"source": "https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a",
"target": {
"file": "full/src/main/java/apoc/metrics/Metrics.java",
"function": "loadCsvForMetric"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-42767-6b23d2f3",
"digest": {
"length": 158,
"function_hash": "148235860615581967438097351628586614164"
},
"source": "https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a",
"target": {
"file": "full/src/test/java/apoc/metrics/MetricsTest.java",
"function": "shouldListMetrics"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-42767-7a4dff55",
"digest": {
"length": 776,
"function_hash": "182662720706030460458167050211698383750"
},
"source": "https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a",
"target": {
"file": "full/src/test/java/apoc/metrics/MetricsTest.java",
"function": "beforeAll"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-42767-81b2b801",
"digest": {
"length": 103,
"function_hash": "281692202849863382705659314443838687303"
},
"source": "https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a",
"target": {
"file": "core/src/main/java/apoc/util/ApocUrlStreamHandlerFactory.java",
"function": "createURLStreamHandler"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-42767-8598f591",
"digest": {
"threshold": 0.9,
"line_hashes": [
"118724760598893317982475357391888250702",
"42787929835364742382331780057433172078",
"16470593785582350785397032901801234475"
]
},
"source": "https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a",
"target": {
"file": "core/src/main/java/apoc/util/ApocUrlStreamHandlerFactory.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-42767-9882e414",
"digest": {
"threshold": 0.9,
"line_hashes": [
"95193999362841661895289845896028243311",
"261693692348930040984612887687535111589",
"245119315153008729244130802157176054276",
"312228315934111725499004949396862767107"
]
},
"source": "https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a",
"target": {
"file": "full/src/main/java/apoc/metrics/Metrics.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-42767-cddbee72",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326407374985357365592746360777064624085",
"197118873685740969565063317695628189996",
"112294612097618583592768992805148845109",
"164547746798137424238900755296927338998",
"126078213229550900351017173744347645068",
"135150134212647040508387277717315844543",
"332306860352394965052039383555502549879",
"162764096537427463671519790558088939497",
"221997739649930657196741760142003088791",
"55687417267536926984773132019460202768",
"289327744451055700867636982514277268897",
"151103724863842922547844729830969069402",
"115645540087760266184531019474230504491",
"168158000555892453138181644095029972025",
"169871252963711939556104895977598583812",
"76255239339210194307863618699059398263",
"50821939529835205129435492129792887666",
"114034237037236198280404289766811056715",
"125866287381025221960492068262448416556",
"298411769115905202885627970124493109980",
"254213154127773681350157233177394834828",
"184424694594279896009214389812614281830",
"46707607899408460326253782815611406143",
"317896526428701706407315656040695414705",
"250640465049932201846732307601903714749"
]
},
"source": "https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/52a0958220ed2998225bce4548636a037ed9d16a",
"target": {
"file": "full/src/test/java/apoc/metrics/MetricsTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:08:53Z"
}
}
],
"modified": "2026-10-20T14:08:53.505710883Z",
"provider": "osv",
"references": [
"https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-4mpj-488r-vh6m",
"https://neo4j.com"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:neo4j:awesome_procedures:*:*:*:*:*:neo4j:*:*"
],
"vendor_product": "neo4j:awesome_procedures",
"extracted_events": [
{
"range": [
{
"introduced": "4.2.0.0"
},
{
"fixed": "4.2.10"
}
],
"source": "CPE_RANGE"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-42767",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388593,
"published_at": "2022-03-01T02:15:07.37+00:00"
}