CVE-2013-6397: Apache Solr

Medium severity, CVSS 4.3. EPSS: 56.3% chance of exploitation in the next 30 days.

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.

Affected products

• Apache Solr: up to and including 4.5.1; version 4.0.0 only; version 4.1.0 only; version 4.2.0 only; version 4.2.1 only; version 4.3.0 only; …

Published 2013-12-07. Last modified 2026-06-17.