dptsec/cve-2026-22444Proof-of-concept exploit for CVE-2026-22444, an Apache Solr UNC path validation flaw enabling RCE and NTLM hash disclosure on Windows standalone mode.
Apache Solr UNC Path Validation Vulnerability
This vulnerability was discovered and disclosed to Apache in 2025. It affects Apache Solr's core creation functionality, where network access to UNC paths occurs before path validation checks are performed. On Windows systems running in standalone mode, this results in RCE when authentication is not enabled or the user has permissions to create cores.
The vulnerability was reported to Apache and publicly disclosed on the oss-security mailing list:
Official Advisory: https://www.openwall.com/lists/oss-security/2026/01/20/5
The vulnerability exists in CoreContainer.java where the CoreDescriptor constructor triggers network operations before UNC path validation:
instancePath.toAbsolutePath() may resolve UNC paths over the networkFiles.exists() checks execute network callsFiles.newInputStream() performs network readsassertPathAllowed() occurs only after these operationsexploit.py - Proof of concept exploitfiles/ - Supporting files for exploitation (configset)