CVE-2015-5531

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

94.79% chance of exploitation in the next 30 days, 100th percentile

Nuclei

medium · CWE-22

Published

2015-08-17

Updated

2024-08-06

Proof-of-concept exploits (6)

• M0ge/CVE-2015-5531-POC2★ · 2022-09-21
• Mariam-kabu/cybersec-labs1★ · 2024-07-09
• j-jasson/CVE-2015-5531-POC2★ · 2022-09-21
• moonwayy/hindicybersec1★ · 2024-07-09
• xpgdgit/CVE-2015-55310★ · 2022-08-01
• MoCh3n/CVE-2015-5531-POC

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-5531.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/elasticsearch_trav…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/38383

Vulhub environments (1)

• vulhub/vulhub/tree/master/elasticsearch/CVE-2015-5531

Exploit collections (2)

• chaitin/xray/blob/master/pocs/elasticsearch-cve-2015-5531.yml
• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2015/CVE-2015-5531.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-43798
• CVE-2022-22947
• CVE-2025-34046
• CVE-2017-9841
• CVE-2014-3120
• CVE-2015-1427