The create core API in Apache Solr versions 8.6 through 9.10.0 does not fully validate API parameters, allowing Solr to read file-system paths that should be blocked by the allowPaths setting. This flaw can let an attacker create new core instances using arbitrary config sets that exist on the underlying filesystem, and on Windows systems configured to allow UNC paths it may also expose NTLM "user" hashes as part of read‑only file access. The consequence is that an attacker could expand deployment configuration without proper authorization and potentially obtain sensitive authentication material.

The vulnerability affects deployments of Apache Solr 8.6 to 9.10.0 that run in standalone mode, employ the allowPaths security setting to restrict file access, and expose the create core API to users who are not fully trusted. Systems that have RuleBasedAuthorizationPlugin disabled or have granted the core‑admin‑edit permission to non‑admin roles are particularly susceptible.

With a CVSS score of 7.1 the flaw is considered high severity. The EPSS score of less than 1% suggests a low current exploitation probability, and it is not listed in the CISA KEV catalog. The likely attack vector is a remote API request to the core creation endpoint, which, if permitted to an untrusted user, can be abused. Proper authorization controls or disabling the vulnerable API are required to mitigate this risk. The solution is a patch or upgrade to a version where the issue is fixed.