CVE-2022-37423: Neo4j Graph apoc plugins Partial Path Traversal Vulnerability
Summary
CVE-2022-37423: Neo4j Graph apoc plugins Partial Path Traversal Vulnerability. Affects org.neo4j.procedure:apoc across 2 version ranges.
< 4.3.0.7
>= 4.4.0.0, < 4.4.0.8
Fixed in 4.3.0.7 or 4.4.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Neo4j Graph is a popular graph database that allows users to store, query, and analyze highly connected data. It provides a flexible and scalable platform for building applications that require complex data relationships. The apoc plugins in Neo4j Graph extend its functionality by providing additional procedures and functions. These plugins are widely used by developers to enhance their applications with advanced graph processing capabilities.
Vulnerability Detail
A partial Directory Traversal Vulnerability has been discovered in the apoc.log.stream function of the apoc plugins in Neo4j Graph. This vulnerability allows a malicious actor to potentially break out of the expected directory and access sibling directories. Although the impact is limited to sibling directories, it can still pose a security risk if sensitive information or critical system files are stored in those directories. An attacker could exploit this vulnerability to gain unauthorized access to sensitive data or execute arbitrary code.
How To Fix
Latest published version: 4.4.0.40 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.3.0.74.3.0.7 -
>= 4.4.0.0, < 4.4.0.84.4.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the library is not feasible, you can implement a workaround by controlling the allowlist of functions that can be used in your system. By configuring the config_dbms.security.procedures.allowlist setting, you can restrict the usage of the apoc.log.stream function or any other vulnerable functions. This will prevent potential exploitation of the vulnerability, but it may also limit the functionality of your application. Therefore, upgrading to the patched version is the recommended solution.
Conclusion
The partial Directory Traversal Vulnerability in the apoc plugins of Neo4j Graph can be mitigated by upgrading to the latest released version of the database. If upgrading is not possible, controlling the allowlist of functions can serve as a temporary workaround. It is important to take prompt action to ensure the security of your Neo4j Graph deployment. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.neo4j.procedure:apoc →
FAQ
This vulnerability allows an attacker to break out of the expected directory and access sibling directories. Although the impact is limited to sibling directories, it can still pose a security risk if sensitive information or critical system files are stored in those directories.
To fix this vulnerability, you should upgrade to the latest released version of Neo4j Graph that is compatible with your current version. The minimum versions containing the patch for this vulnerability are 4.4.0.8 and 4.3.0.7.
Yes, if upgrading the library is not feasible, you can control the allowlist of functions that can be used in your system. By configuring the config_dbms.security.procedures.allowlist setting, you can restrict the usage of the apoc.log.stream function or any other vulnerable functions.
No, this vulnerability requires an attacker to have access to the system where the vulnerable Neo4j Graph database is running. It cannot be exploited remotely.
This vulnerability was reported by Jonathan Leitschuh.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.neo4j.procedure:apoc.
