Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-121489

Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Juneau

Default version status: unaffected

  • 0 to < 9.2.1affected
pkg:maven/org.apache.juneau/juneau-microservice-core

Apache Software Foundation Apache Juneau

Default version status: unaffected

  • 0 to < 9.2.1affected
pkg:maven/org.apache.juneau/juneau-commons

References