CVE-2026-8384

State: Published
Severity: 5.3 Medium
Published: Jul 14, 2026
Updated: Jul 14, 2026
Reserved: May 12, 2026

Read the record on cve.org

Description

In Eclipse Jetty, an HTTP URI of this form:

/public;/../admin/secret.txt

results in an unresolved path of:

/public/../admin/secret.txt

instead of the expected:

/admin/secret.txt

Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).

However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	eclipse

Weaknesses

CWE-647

Affected Products

Product	Versions
Eclipse JettyEclipse Foundation	12.0.0 through 12.0.34Affected 12.1.0 through 12.1.8Affected

References

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.