CVE-2021-42767: Neo4j Graph Database Path Traversal Vulnerability
Summary
CVE-2021-42767: Neo4j Graph Database vulnerable to Path Traversal. Affects org.neo4j.procedure:apoc across 4 version ranges.
< 3.5.17
>= 4.2.0, < 4.2.10
>= 4.3.0.0, < 4.3.0.4
>= 4.4.0.0, < 4.4.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Neo4j Graph Database is a popular graph database management system used for storing and querying graph data. It provides powerful features for analyzing and visualizing complex relationships between data entities. The database relies on various plugins, including the apoc plugins, to extend its functionality. However, several functions in the apoc plugins of Neo4j Graph Database are vulnerable to directory traversal attacks.
Vulnerability Detail
The directory traversal vulnerabilities in the apoc plugins of Neo4j Graph Database allow an attacker to retrieve and download files from outside the configured directory on the affected server. In some cases, the attacker can also create files. This can lead to unauthorized access to sensitive information and potential compromise of the server. The vulnerability is rated with a CVSS score of 9.1, indicating a critical severity level.
How To Fix
Latest published version: 4.4.0.40 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.5.173.5.17 -
>= 4.2.0, < 4.2.104.2.10 -
>= 4.3.0.0, < 4.3.0.44.3.0.4 -
>= 4.4.0.0, < 4.4.0.14.4.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the library is not feasible, you can control the allowlist of functions that can be used in your system. Refer to the Neo4j documentation for instructions on configuring the allowlist.
Conclusion
The directory traversal vulnerability in Neo4j Graph Database's apoc plugins poses a critical security risk. It is crucial to upgrade to the patched versions or apply the recommended workarounds to mitigate the vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.neo4j.procedure:apoc →
FAQ
Neo4j Graph Database is a powerful graph database management system used for storing and querying graph data. It provides advanced features for analyzing complex relationships between data entities.
Apoc plugins are additional plugins that extend the functionality of Neo4j Graph Database. They provide additional procedures and functions for data manipulation and analysis.
Directory traversal vulnerability, also known as path traversal vulnerability, is a security flaw that allows an attacker to access files and directories outside the intended directory structure. In this case, the vulnerability allows the attacker to retrieve and download files from outside the configured directory on the affected server.
The vulnerability can lead to unauthorized access to sensitive files and information stored on the server. It can also allow the attacker to create files, potentially leading to further compromise of the server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.neo4j.procedure:apoc.
