Apache Solr 6.x < 6.4.1 Directory Traversal

When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. Solr versions 5.5.4 and 6.x 6.4.1 do not validate this file name allowing for a remote, unauthenticated attacker to access any files readable by...