CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108	Vendor Advisory Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:eclipse:jetty::::::::
	cpe:2.3:a:eclipse:jetty::::::::

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) En Eclipse Jetty, una URI HTTP de esta forma: /public;/.. / admin/secret.txt resulta en una ruta no resuelta de: /public/.. / admin/secret.txt en lugar de la esperada: /admin/secret.txt Jetty en sí no se ve afectado, ya que no servirá el archivo secret.txt porque no pasará el verificador de alias (solo se sirven recursos resueltos). Sin embargo, las aplicaciones web que dependen de que Jetty proporcione rutas resueltas pueden confundirse al recibir una ruta no resuelta.

Information

Published : 2026-07-14 09:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-8384

Mitre link : CVE-2026-8384

CVE.ORG link : CVE-2026-8384

JSON object : View

Products Affected

eclipse

jetty

CWE

CWE-647

Use of Non-Canonical URL Paths for Authorization Decisions

{"id": "CVE-2026-8384", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8384", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T12:18:08.648859Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"repo": "https://github.com/jetty/jetty.project", "vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "versions": [{"status": "affected", "version": "12.0.0", "versionType": "semver", "lessThanOrEqual": "12.0.34"}, {"status": "affected", "version": "12.1.0", "versionType": "semver", "lessThanOrEqual": "12.1.8"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T09:16:42.050", "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108", "tags": ["Vendor Advisory", "Exploit"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-647"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path."}, {"lang": "es", "value": "En Eclipse Jetty, una URI HTTP de esta forma:\n\n/public;/.. / admin/secret.txt\n\nresulta en una ruta no resuelta de:\n\n/public/.. / admin/secret.txt\n\nen lugar de la esperada:\n\n/admin/secret.txt\n\nJetty en s\u00ed no se ve afectado, ya que no servir\u00e1 el archivo secret.txt porque no pasar\u00e1 el verificador de alias (solo se sirven recursos resueltos).\n\nSin embargo, las aplicaciones web que dependen de que Jetty proporcione rutas resueltas pueden confundirse al recibir una ruta no resuelta."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "655AA819-8D55-40C7-BCF3-F7D2AC085C41", "versionEndExcluding": "12.0.35", "versionStartIncluding": "12.0.0"}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF2AE57E-99D5-4181-A5B6-77A5FFBEB3F1", "versionEndExcluding": "12.1.9", "versionStartIncluding": "12.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}