CVE-2013-6397: Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers t...

Security readout for executives and security teams

This flaw lets a remote user make vulnerable Apache Solr read files from the server through the XSLT response path. The business risk is disclosure of secrets, configuration files, or other sensitive data from search infrastructure. Sources also note it can combine with a separate XXE issue to reach files across restricted network boundaries. Exposure is most likely where Apache Solr before 4.6 is reachable by untrusted users or applications and the XSLT response writer path is available. Internet-facing or shared Solr deployments carry higher risk. The provided data does not identify specific downstream products beyond Apache Solr and Red Hat packages. Prioritize remediation for externally reachable or multi-tenant Solr systems because the impact is sensitive file disclosure. There is no KEV-backed active exploitation evidence in the provided sources, but the vulnerability is old, publicly documented, and should be eliminated from supported environments. Mitigation focus: Upgrade Apache Solr to 4.6.0 or a later supported fixed release.; Apply vendor fixed packages referenced by Red Hat advisories where applicable.; Restrict untrusted access to Solr request handlers until fixed..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.