CVE-2026-121489
Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.
| CWE | CWE-22 |
| Vendor | apache software foundation |
| Product | apache juneau |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for apache software foundation apache juneau
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache juneau are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Apache Software Foundation / Apache Juneau
0 < 9.2.1
Apache Software Foundation / Apache Juneau
0 < 9.2.1
References
Credits
LTSHFWJT