CVE-2015-4165: The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read...

Security readout for executives and security teams

Older Elasticsearch versions before 1.6.0 have a snapshot API flaw that lets a remote authenticated user create arbitrary snapshot metadata files. In a specific shared-host scenario, that file creation could contribute to arbitrary code execution through another local application. Exposure is most likely in legacy Elasticsearch deployments below 1.6.0 where authenticated users can reach snapshot APIs and Elasticsearch shares writable paths with another executable application context. Prioritize remediation for any remaining legacy Elasticsearch systems. The risk is not broadly automatic, but successful exploitation could cross from file creation into code execution under the right operating conditions. Mitigation focus: Upgrade Elasticsearch to 1.6.0 or later, based on the affected range.; Restrict snapshot API access to trusted administrative users only.; Remove shared writable paths between Elasticsearch and code-executing applications..

Prepared

Jun 12, 2026, 21:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.