CVE-2026-121489
Received Received - Intake

Path Traversal in Apache Juneau

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-121489
EUVD
EUVD-2026-117414

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Juneau 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Path Traversal vulnerability in Apache Juneau where the DirectoryResource microservice fails to restrict file access to its configured root directory. When certain settings (view, upload, delete) are enabled, attackers can read, write, or delete files outside the intended directory if the server process has access.

Detection Guidance

Detecting this vulnerability requires checking if Apache Juneau is running with vulnerable settings. Inspect server logs for unusual file access patterns outside the configured root directory. Enable and review access logs for the DirectoryResource microservice if enabled. Check if the vulnerable settings (view, upload, delete) are enabled in the configuration.

Impact Analysis

An attacker could access sensitive files, modify or delete critical data, or upload malicious files. This could lead to data breaches, system compromise, or service disruption, especially if the server has high privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately upgrade Apache Juneau to version 9.2.1 or later. Disable the DirectoryResource microservice or its vulnerable settings (view, upload, delete) if not required. Restrict server process permissions to minimize potential file system access. Monitor for any suspicious file operations or unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121489. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...