Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files

{
  "id": "966391097c2be6f8a9e1c9fde56ab362155cca7948dc2f227ab3a2cc8b3165df",
  "url": "https://solr.apache.org/cve-2025-24814-apache-solr-core-creation-with-trusted-configset-can-use-arbitrary-untrusted-files.html",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Apache Solr: Core-creation with \"trusted\" configset can use arbitrary untrusted files",
    "summary": "Apache Solr versions through 9.7 are affected when using FileSystemConfigSetService without authentication and authorization. Upgrade to Solr 9.8.0, which mitigates the issue by disabling use of the specified tags by default; enabling authentication and authorization or switching to SolrCloud are also recommended mitigations.",
    "evidence": "Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \"\" tags by default.",
    "products": [
      {
        "name": {
          "value": "Apache Solr",
          "evidence": "This issue affects all Apache Solr versions up through Solr 9.7."
        },
        "prerequisites": [
          {
            "value": "use the \"FileSystemConfigSetService\" component",
            "evidence": "Solr instances that (1) use the \"FileSystemConfigSetService\" component (the default in \"standalone\" or \"user-managed\" mode), and (2) are running without authentication and authorization are vulnerable"
          },
          {
            "value": "running without authentication and authorization",
            "evidence": "Solr instances that (1) use the \"FileSystemConfigSetService\" component (the default in \"standalone\" or \"user-managed\" mode), and (2) are running without authentication and authorization are vulnerable"
          }
        ],
        "fixed_versions": [
          {
            "value": "Solr 9.8.0",
            "evidence": "Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of \"\" tags by default."
          }
        ],
        "affected_versions": [
          {
            "value": "through Solr 9.7",
            "evidence": "This issue affects all Apache Solr versions up through Solr 9.7."
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2025-24814",
        "evidence": "CVE - CVE-2025-24814"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-apache-solr-security",
  "document_id": 22974,
  "published_at": "2025-01-26T00:00:00+00:00"
}