CVE-2026-121489: falha crítica em Apache Juneau
Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 10epss 0.5%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau.
The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access.
This issue affects Apache Juneau: through 9.2.0.
Users are recommended to upgrade to version 9.2.1, which fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Produtos afetados
Apache Software Foundation · Apache JuneauCVEs relacionadas — Apache Juneau
No mesmo produto, das mais perigosas para as menos.
CVE-2026-73098CRITICALApache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsingEPSS 0.5%CVE-2026-96677CRITICALApache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chromeEPSS 0.4%CVE-2026-73117CRITICALApache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request dataEPSS 0.4%CVE-2026-73101CRITICALApache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaultsEPSS 0.4%CVE-2026-73100CRITICALApache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errorsEPSS 0.4%CVE-2026-73095HIGHApache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handlingEPSS 0.4%