CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Apache Solr DataImportHandler Code Injection Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Affected products
apache: solr; debian: debian linux
References10
- issues.apache.org/jira/browse/SOLR-13669 MitigationVendor Advisory
- issues.apache.org/jira/browse/SOLR-13669 MitigationVendor Advisory
- lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9… Mailing ListPatch
- lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413… Mailing ListPatch
- lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9… Mailing ListPatch
- lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413… Mailing ListPatch
- lists.apache.org/thread.html/1addbb49a1fc0947fb32ca663d76d93cfa… Mailing List
- lists.apache.org/thread.html/42cc4d334ba33905b872a0aa00d6a48139… Mailing List
- lists.apache.org/thread.html/55880d48e38ba9e8c41a3b9e41051dbfde… Mailing List
- lists.apache.org/thread.html/6f2d61bd8732224c5fd3bdd84798f8e01e… Mailing List
Metrics
- CVSS 3.1
-
7.2
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 84% percentile: 100 · as of 10 November 2026
- CWE
- CWE-94
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.