← Back

CVE-2026-8384

nvd nist
Published: Jul 14, 2026Modified: Jul 14, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: emo@eclipse.org (Secondary)

Description

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

Affected (2)

Products: Eclipse: Jetty
Eclipse
1 product
Jetty
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Eclipse
Jetty
From 12.0.0 to 12.0.35
Jetty
From 12.1.0 to 12.1.9

Related CWEs

CWE-647
Use of Non-Canonical URL Paths for Authorization Decisions
The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

References (1)

Source: emo@eclipse.org
Vendor AdvisoryExploit

Timeline

No history available yet.