AI description
CVE-2026-121489 is a path traversal vulnerability affecting Apache Juneau up to version 9.2.0. The issue resides within the `DirectoryResource` microservice, which fails to properly restrict request paths to its configured root directory. If an application has enabled the resource's view, upload, or delete settings—which are disabled by default—an attacker can exploit this flaw to read, write, or delete files outside the root directory, accessing any location on the system that the server process has permissions to reach. To mitigate this vulnerability, users are advised to upgrade to Apache Juneau version 9.2.1, which addresses the path traversal issue. Additionally, organizations are recommended to keep the view, upload, and delete settings disabled unless they are strictly necessary for operations.
- Description
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
- Source
- security@apache.org
- NVD status
- Deferred
CVSS 4.0
- Type
- Secondary
- Base score
- 10
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- CRITICAL
- security@apache.org
- CWE-22
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
8