CVE-2021-42767

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-01 · updated 2026-06-17
Weakness: CWE-22

Description

A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read local files, and sometimes create local files. This is fixed in 3.5.17, 4.2.10, 4.3.0.4, and 4.4.0.1.

Affected products

neo4j Awesome Procedures: before 3.5.0.17; from 4.2.0.0 before 4.2.10; from 4.3.0.0 before 4.3.0.4; from 4.4.0.0 before 4.4.0.1 — fixed in 3.5.0.17, 4.2.10, 4.3.0.4, 4.4.0.1

How to fix

Upgrade to a fixed version: neo4j Awesome Procedures 3.5.0.17, 4.2.10, 4.3.0.4, 4.4.0.1. Check the vendor advisory for mitigations.

References

https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-4mpj-488r-vh6m
https://neo4j.com
https://github.com/neo4j-contrib/neo4j-apoc-procedures/security/advisories/GHSA-4mpj-488r-vh6m
https://neo4j.com

Get alerted when CVE-2021-42767 or the next vulnerability affects your stack