Neo4j Graph Database vulnerable to Path Traversal
Impact
Directory Traversal Vulnerabilities found in several functions of apoc plugins in Neo4j Graph database. The attacker can retrieve and download files from outside the configured directory on the affected server. Under some circumstances, the attacker can also create files.
Patches
The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability (for Neo4j 4.2, 4.3, and 4.4 bundled with APOC, upgrade to the appropriate patched version): 3.5 - bundle n/a, standalone 3.5.0.17 4.2 - bundle 4.2.13, standalone 4.2.0.10 4.3 - bundle 4.3.9, standalone 4.3.0.4 4.4 - bundle 4.4.2, standalone 4.4.0.1
Workarounds
If you cannot upgrade the library, you can control the allowlist of the functions that can be used in your system:
For more information
If you have any questions or comments about this advisory:
- Open an issue in neo4j-apoc-procedures
- Email us at security@neo4j.com
Credits
We want to publicly recognize the contribution of Nicolai Grødum from the Red Team of PwC Norway for reporting this issue and following the responsible disclosure policy.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.neo4j.procedure:apoc | < 3.5.17, >= 4.2.0, < 4.2.10, >= 4.3.0.0, < 4.3.0.4, >= 4.4.0.0, < 4.4.0.1 | 3.5.17, 4.2.10, 4.3.0.4, 4.4.0.1 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-22- Platform
- Java / Kotlin (Maven)
- Package
org.neo4j.procedure:apoc- Disclosed
- 01.02.2022
- Updated
- 11.10.2026 12:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-4mpj-488r-vh6m - CC BY 4.0
Vulnerability history: org.neo4j.procedure:apoc
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 12.2018 02.2023
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 1
- Medium 2
Disclosures per year
- 2018: 1
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 2
- 2023: 2
- 2024: 0
- 2025: 0
- 2026: 0
-
Neo4j Graph Database vulnerable to Path Traversal this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.