CVE-2026-114370

Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in Undertow Web Server

Publication date: 2026-10-21

Last updated on: 2026-11-06

Assigner: redhat-SADP

Description

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-06

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114370

EUVD

EUVD-2026-107307

Affected Vendors & Products

Vendor	Product	Version / Range
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	*
Red Hat	Red Hat JBoss Enterprise Application Platform 7	*
Red Hat	Red Hat JBoss Enterprise Application Platform 7	*
Red Hat	Red Hat JBoss Enterprise Application Platform 7	*
Red Hat	Red Hat JBoss Enterprise Application Platform 7	*
Red Hat	Red Hat JBoss Enterprise Application Platform 8	*
Red Hat	Red Hat Single Sign-On 7	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Undertow web server's PathResourceManager component, which serves static files. The flaw allows attackers to bypass path restrictions by exploiting symbolic links. The component checks if a link's target starts with a safe directory name but doesn't verify the full directory path, enabling access to sibling directories with similar prefixes.

Detection Guidance

Check Undertow server logs for unusual file access patterns or symlink-related errors. Inspect configuration files for PathResourceManager settings. Use tools like 'find' or 'ls' to verify directory and symlink structures in web root directories.

Impact Analysis

An attacker could read sensitive files from unauthorized directories if they share a prefix with an allowed directory. Exploitation requires a specific configuration involving symbolic links and directory naming patterns. The impact is limited as it requires precise conditions to succeed.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to sensitive files through symlink traversal. If exploited, it may lead to unauthorized data exposure, violating confidentiality requirements under these regulations.

Mitigation Strategies

Update Undertow to the latest patched version if available. Review and restrict symlink usage in web directories. Implement stricter path validation in PathResourceManager configuration. Monitor for unauthorized file access attempts.

Hi! I’m here to help you understand CVE-2026-114370. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...