CVE-2025-11966

In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/303	Exploit Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:eclipse:vert.x::::::::
	cpe:2.3:a:eclipse:vert.x::::::::

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) En las versiones de Eclipse Vert.x [4.0.0, 4.5.21] y [5.0.0, 5.0.4], cuando el 'listado de directorios' está habilitado, los nombres de archivos y directorios se insertan en el HTML generado sin el escape adecuado en los atributos href, title y link. Un atacante que puede crear o renombrar archivos o directorios dentro de una ruta servida puede elaborar nombres de archivo que contengan scripts maliciosos o contenido HTML, lo que lleva a un cross-site scripting (XSS) almacenado que se ejecuta en el contexto de los usuarios que ven el listado de directorios afectado.

Information

Published : 2025-10-22 15:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-11966

Mitre link : CVE-2025-11966

CVE.ORG link : CVE-2025-11966

JSON object : View

Products Affected

eclipse

vert.x

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2025-11966", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11966", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T15:24:31.799457Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"vendor": "Eclipse Foundation", "product": "Vert.x", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.5.22", "versionType": "maven"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.0.5", "versionType": "maven"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-22T15:15:31.730", "references": [{"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/303", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when \"directory listing\" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing."}, {"lang": "es", "value": "En las versiones de Eclipse Vert.x [4.0.0, 4.5.21] y [5.0.0, 5.0.4], cuando el 'listado de directorios' est\u00e1 habilitado, los nombres de archivos y directorios se insertan en el HTML generado sin el escape adecuado en los atributos href, title y link. Un atacante que puede crear o renombrar archivos o directorios dentro de una ruta servida puede elaborar nombres de archivo que contengan scripts maliciosos o contenido HTML, lo que lleva a un cross-site scripting (XSS) almacenado que se ejecuta en el contexto de los usuarios que ven el listado de directorios afectado."}], "lastModified": "2026-10-08T11:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78323EAC-F580-4CFC-AC88-A36A6D466875", "versionEndExcluding": "4.5.22", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BA9AC40-ED8B-4031-A4EF-BC798A732173", "versionEndExcluding": "5.0.5", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}