ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
View the template here CVE-2015-5531.yaml
References:
https://github.com/vulhub/vulhub/tree/master/elasticsearch/CVE-2015-5531