CVE-2026-79653
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6epss 0.4%
exploitation probability
0.4%top 69% of all CVEs
observed exploitation
nono source reports it
In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal.
The immediate workaround is to disable enable.attachment.store.to.file.system or update to fixed versions.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
Eclipse Foundation · Eclipse SW360