CVE-2013-6397: Apache Solr XSLT response writer path traversal file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote arbitrary file read with a public exploit reference and very high EPSS, though CVSS v2 rates it only medium and it is not in KEV.

What it is

Apache Solr before 4.6 contains a directory traversal flaw in SolrResourceLoader. When the response writer is set to XSLT, the tr parameter accepts .. sequences or full pathnames, letting a remote attacker read arbitrary files from the Solr host. The issue can also be chained with a separate XXE flaw to reach files across restricted network boundaries.

Impact

An attacker gains read access to arbitrary files on the Solr server, which can expose configuration, credentials and other sensitive data. Chained with XXE, the read can extend to systems otherwise unreachable from the attacker.

Attack surface

Reached remotely over the network via a crafted request to solr/select/ with wt=XSLT and a malicious tr parameter. No authentication is required per the CVSS vector (Au:N), though the vector notes medium access complexity (AC:M).

Exploitation

An exploit reference is present and EPSS is high (0.56255, 99th percentile), but the CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Upgrade Apache Solr to 4.6 or later, which contains the fix tracked in SOLR-4882.
• Apply the referenced Red Hat errata (RHSA-2013-1844, RHSA-2014-0029) if running the vendor-packaged build.
• Disable or restrict the XSLT response writer (wt=XSLT) where it is not required.
• Do not expose Solr directly to untrusted networks; place it behind authentication and network controls.
• Address any XXE issues in the same deployment, since this flaw can be chained with them.

Detection

• Search Solr request logs for wt=XSLT combined with tr parameters containing '..' or absolute paths.
• Alert on requests to solr/select/ that use the XSLT response writer from unexpected source addresses.
• Monitor for outbound or file-access activity consistent with reading files outside the Solr content directory.
• Review Solr versions in inventory against the 4.6 fixed release.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.