CVE-2022-23532: org.neo4j.procedure:apoc Path Traversal Vulnerability
Summary
CVE-2022-23532: org.neo4j.procedure:apoc Path Traversal Vulnerability. Affects org.neo4j.procedure:apoc across 2 version ranges.
< 4.3.0.12
>= 4.4.0.0, < 4.4.0.12
Fixed in 4.3.0.12 or 4.4.0.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.neo4j.procedure:apoc package is an open-source plugin for the Neo4j Graph database. It provides additional procedures for data export and manipulation. The package is widely used in various applications and allows users to execute custom queries and export data in different formats.
Vulnerability Detail
A Path Traversal Vulnerability has been discovered in the apoc.export.* procedures of the apoc plugin in Neo4j Graph database. This vulnerability allows an attacker to potentially break out of the expected directory and create files in unintended locations. However, the vulnerability does not allow overwriting of existing files. To exploit this vulnerability, the attacker would need access to execute arbitrary queries, either through an authenticated Neo4j client or a Cypher injection vulnerability in an application. The procedure must also be allowed in the Neo4j configuration and the apoc.export.file.enabled setting must be set to true. An example of an exploit query on a UNIX system is: CALL apoc.export.csv.query('RETURN 1', 'file:///../../../tmp/test.txt', {})
How To Fix
Latest published version: 4.4.0.40 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.3.0.124.3.0.12 -
>= 4.4.0.0, < 4.4.0.124.4.0.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the library is not possible, you can implement the following workarounds:
- Control the allowlist of procedures that can be used in your system. This can be done by modifying the neo4j configuration and specifying the allowed procedures.
- Disable local file access by setting apoc.export.file.enabled=false in the apoc configuration.
Conclusion
The org.neo4j.procedure:apoc package is vulnerable to a path traversal vulnerability in the apoc.export.* procedures. This vulnerability can be mitigated by upgrading to the latest released version of the package or implementing the recommended workarounds. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.neo4j.procedure:apoc →
FAQ
The vulnerability allows an attacker to create files in unintended locations, potentially leading to unauthorized access or disruption of the system. However, the vulnerability does not allow overwriting of existing files.
The vulnerability can be exploited by executing an arbitrary query with access to the apoc.export.* procedures. This can be achieved through an authenticated Neo4j client or a Cypher injection vulnerability in an application.
The vulnerability affects versions prior to 4.4.0.12 and 4.3.0.12 of the org.neo4j.procedure:apoc package.
Yes, patches have been released to fix this vulnerability. It is recommended to upgrade to version 4.4.0.12 or 4.3.0.12 of the org.neo4j.procedure:apoc package.
Yes, you can control the allowlist of procedures that can be used in your system and disable local file access to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.neo4j.procedure:apoc.
