CVE-2026-83557
Received Received - Intake

Path Traversal in Jackson Databind

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: HeroDevs

Description
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true unconditionally for every base type outside that set. java.lang.Comparable was absent from the list despite being implemented by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable, which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type identifier for essentially any class implementing Comparable. This yields an attacker-controlled object instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods on the value. No class implementing Comparable has been identified that yields code execution through deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that method structurally requires an explicit PolymorphicTypeValidator argument. This affects com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-83557
EUVD
EUVD-2026-69250

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
fasterxml jackson-databind to 2.18.10 (exc)
fasterxml jackson-databind to 2.21.6 (exc)
fasterxml jackson-databind to 2.22.2 (exc)
fasterxml jackson-databind to 3.1.6 (exc)
fasterxml jackson-databind to 3.2.2 (exc)
com.fasterxml.jackson jackson-databind to 2.18.10 (exc)
com.fasterxml.jackson jackson-databind to 2.21.6 (exc)
com.fasterxml.jackson jackson-databind to 2.22.2 (exc)
tools.jackson jackson-databind to 3.1.6 (exc)
tools.jackson jackson-databind to 3.2.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves DefaultBaseTypeLimitingValidator in Jackson Databind. When @JsonTypeInfo is used without a custom validator, it automatically applies this validator which blocks certain unsafe base types. However, java.lang.Comparable was missing from the list of blocked types despite being widely implemented. This allows attackers to specify any class implementing Comparable, leading to object instantiation with attacker-controlled data. For example, an attacker could create a java.io.File with an arbitrary path, which may enable path traversal if the application uses the file path unsafely.

The affected versions are jackson-databind 2.11.0 to 2.18.9, 2.19.0 to 2.21.5, 2.22.0 to 2.22.1, and jackson-databind 3.0.0 to 3.1.5, 3.2.0 to 3.2.1.

Detection Guidance

This vulnerability is specific to applications using Jackson Databind with @JsonTypeInfo without a custom PolymorphicTypeValidator. Check if your application uses Jackson Databind versions 2.11.0 to 2.18.9, 2.19.0 to 2.21.5, 2.22.0 to 2.22.1, 3.0.0 to 3.1.5, or 3.2.0 to 3.2.1. Review code for @JsonTypeInfo annotations with Comparable as base type.

Impact Analysis

An attacker could exploit this to create objects of arbitrary classes implementing Comparable, such as java.io.File with a malicious path. If your application later uses this file path in a sensitive operation like file deletion or reading, it could lead to unauthorized file access or deletion. While code execution via deserialization alone has not been identified, the risk of path traversal or similar attacks exists.

Compliance Impact

This vulnerability could lead to unauthorized file access or manipulation, violating data confidentiality and integrity principles in GDPR and HIPAA. If exploited, it may result in unauthorized access to sensitive files, triggering compliance violations related to data protection and breach notification requirements.

Mitigation Strategies

Upgrade Jackson Databind to versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 or later. If upgrading is not possible, ensure all @JsonTypeInfo annotations include a custom PolymorphicTypeValidator that explicitly denies unsafe base types.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83557. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart