CVE-2015-5531: Elasticsearch snapshot API path traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote file read with very high EPSS and public exploit code, though CVSS v2 rates it only medium severity.

What it is

Elasticsearch before 1.6.1 contains a directory traversal flaw in the snapshot API that lets remote attackers read arbitrary files. The vulnerability is reachable over the network without authentication, so any exposed instance is at risk of file disclosure.

Impact

An attacker can read files on the host filesystem that the Elasticsearch process can access, potentially exposing configuration, credentials, or other sensitive data. The CVSS v2 vector shows partial confidentiality impact only, with no integrity or availability effect.

Attack surface

Reached over the network via snapshot API calls; the CVSS vector AV:N/AC:L/Au:N indicates no authentication or user interaction is required. The description does not specify the exact request parameters, only that the vectors are related to snapshot API calls.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.94788, 99.855th percentile) and public exploit references exist on Exploit-DB and Packet Storm, indicating mature public exploitation.

What to do

• Upgrade Elasticsearch to 1.6.1 or later as the primary fix.
• Restrict network access to the Elasticsearch HTTP API so it is not reachable from untrusted networks.
• Enable authentication and authorization on the Elasticsearch API if the deployment supports it.
• Disable or restrict the snapshot API where it is not operationally required.
• Run Elasticsearch with a dedicated low-privilege OS account to limit file exposure.

Detection

• Monitor Elasticsearch logs for snapshot API requests containing path traversal sequences such as ../.
• Alert on HTTP requests to snapshot endpoints from unexpected source IPs or user agents.
• Audit file access by the Elasticsearch process for reads outside expected data and config directories.
• Review exposed Elasticsearch instances for versions prior to 1.6.1.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.