Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem. These replacement config files are treated as "trusted" and can use "<lib>" tags to add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin. This issue affects all Apache Solr versions up through Solr 9.7. Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from "FileSystemConfigSetService"). Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of "<lib>" tags by default.

Solr instances that (1) use the 'FileSystemConfigSetService' component (the default in 'standalone' or 'user-managed'  mode), and (2) are running without authentication and authorization are vulnerable to a sort of privilege escalation  wherein individual 'trusted' configset files can be ignored in favor of potentially-untrusted replacements available  elsewhere on the filesystem.  These replacement config files are treated as 'trusted' and can use '<lib>' tags to  add to Solr's classpath, which an attacker might use to load malicious code as a searchComponent or other plugin.
 This issue affects all Apache Solr versions up through Solr 9.7.  Users can protect against the vulnerability by  enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from 'FileSystemConfigSetService').  Users are also recommended to upgrade to Solr 9.8.0, which mitigates this issue  by disabling use of '<lib>' tags by default.
  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version  number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Core creation allows users to replace trusted configset files with arbitrary configuration Solr     instances that (1) use the FileSystemConfigSetService component (the default in standalone or user-     managed mode), and (2) are running without authentication and authorization are vulnerable to a sort of     privilege escalation wherein individual trusted configset files can be ignored in favor of potentially-     untrusted replacements available elsewhere on the filesystem. These replacement config files are treated     as trusted and can use <lib> tags to add to Solr's classpath, which an attacker might use to load     malicious code as a searchComponent or other plugin. This issue affects all Apache Solr versions up     through Solr 9.7. Users can protect against the vulnerability by enabling authentication and authorization     on their Solr clusters or switching to SolrCloud (and away from FileSystemConfigSetService). Users are     also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of <lib> tags by     default. (CVE-2025-24814)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr
    instances that (1) use the "FileSystemConfigSetService" component (the default in "standalone" or "user-
    managed" mode), and (2) are running without authentication and authorization are vulnerable to a sort of
    privilege escalation wherein individual "trusted" configset files can be ignored in favor of potentially-
    untrusted replacements available elsewhere on the filesystem. These replacement config files are treated
    as "trusted" and can use "<lib>" tags to add to Solr's classpath, which an attacker might use to load
    malicious code as a searchComponent or other plugin. This issue affects all Apache Solr versions up
    through Solr 9.7. Users can protect against the vulnerability by enabling authentication and authorization
    on their Solr clusters or switching to SolrCloud (and away from "FileSystemConfigSetService"). Users are
    also recommended to upgrade to Solr 9.8.0, which mitigates this issue by disabling use of "<lib>" tags by
    default. (CVE-2025-24814)

ID	Name	Product	Family	Severity
265889	Apache Solr < 9.8.0 ConfigSet Privilege Escalation via <lib> Injection (CVE-2025-24814)	Nessus	CGI abuses	medium
256662	Linux Distros Unpatched Vulnerability : CVE-2025-24814	Nessus	Misc.	medium
420774	SCA: security update for org.apache.solr:solr-core (GHSA-68r2-fwcg-qpm8)	Tenable Cloud Security	SCA Checks	critical
420774	SCA: security update for org.apache.solr:solr-core (GHSA-68r2-fwcg-qpm8)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2025-24814

critical

Tenable Plugins

medium

medium

critical

critical