CVE-2026-8384

5.3 Moyenne

Publiée le 14/07/2026 à 11:16 · Modifiée le 14/07/2026 à 20:39 · Analysée par le NVD · Source : emo@eclipse.org

Description

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

Traduire en français

Produits concernés

Eclipse Foundation Eclipse Jetty
Eclipse jetty

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	emo@eclipse.org	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-647

Références

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108 Vendor AdvisoryExploit

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories