CVE-2015-5531: Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch
Summary
CVE-2015-5531: Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch. Affects org.elasticsearch:elasticsearch versions < 1.6.1. Fixed in 1.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Elasticsearch is an open-source search and analytics engine built on Apache Lucene. It provides a distributed, RESTful search and analytics platform for various types of data. Elasticsearch is widely used for its scalability, speed, and real-time search capabilities. However, versions before 1.6.1 are affected by a directory traversal vulnerability.
Vulnerability Detail
The vulnerability in Elasticsearch allows remote attackers to read arbitrary files through unspecified vectors related to snapshot API calls. This directory traversal vulnerability enables an attacker to bypass access restrictions and retrieve sensitive information from the server. The impact of this vulnerability can be significant, as it allows unauthorized access to confidential data stored on the Elasticsearch server.
How To Fix
Latest published version: 9.5.5 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed version of Elasticsearch.
Conclusion
The directory traversal vulnerability in Elasticsearch versions before 1.6.1 can lead to unauthorized access to sensitive files on the server. It is crucial to upgrade to the fixed version to mitigate this security risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.elasticsearch:elasticsearch →
FAQ
The vulnerability allows remote attackers to read arbitrary files on the Elasticsearch server, potentially exposing sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Elasticsearch version is affected by this vulnerability. Simply enter your pom.xml file and it will provide real-time alerts for open-source vulnerabilities.
There are no known exploits publicly available for this vulnerability at the time of writing. However, it is important to patch your Elasticsearch installation to prevent any potential exploitation.
The recommended approach is to upgrade to the fixed version as soon as possible. Applying temporary measures may not provide sufficient protection against this vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-jjq8-vfjq-j6v4/GHSA-jjq8-vfjq-j6v4.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.elasticsearch:elasticsearch.
