CVE-2026-121489
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in…
- Risk score
- 65/100
- CVSS
- 10.0 v4.0
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client c…
- Affected
- See advisory
- Fix
- Upgrade the product to 9.2.1 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
Last activity 5 Nov 2026. Patch Forecast updates every hour.