CRITICALCVSS v4 10.0Vulnerability
CVE-2026-121489
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
Properties
- Cvss score
- 10
- First seen
- 2026-11-05T11:55:23+00:00
- Last seen
- 2026-11-05T11:55:23+00:00
- Euvd assigner
- apache
- Retrieved at
- 2026-11-05T18:06:50+00:00
- Src batch id
- euvd-20261105T133402Z-053d98
- Source url
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117414
- Score
- 10
- Euvd base score version
- 4.0
- Fetched at
- 2026-11-05T13:34:21+00:00
- Euvd vendor
- Apache Software Foundation
- Cvss vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- First seen by Signal
- 2026-11-05T13:34:22+00:00
- Euvd base score
- 10
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Content hash
- 4fd08fe526b4e22968ff313b49bf6a11ce28223c0aa5177ec25ce0fb50ee4c76
- Published at
- 2026-11-05T12:17:49.643
- Last modified
- 2026-11-05T15:01:29.553
- Euvd updated
- 2026-11-05T11:55:23+00:00
- Euvd epss pct
- 0
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph