Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Eclipse Vert.x StaticHandler allows directory traversal on Windows

CVE-2018-12542 · published 8 years ago
Summary

The Eclipse Vert.x StaticHandler in versions 3.0.0 to 3.5.3 doesn't properly handle directory paths on Windows, which could allow an attacker to access unauthorized files. This affects systems that use the StaticHandler to serve files. To protect your system, update to a fixed version of Eclipse Vert.x.

What to do
  • Update vertx io.vertx:vertx-web to version 3.5.4.
Affected software
Ecosystem VendorProductAffected versions
maven vertx io.vertx:vertx-web >= 3.0.0, < 3.5.4
Fix: upgrade to 3.5.4
– eclipse vert.x >= 3.0.0, <= 3.5.3
cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*
Original advisory text
In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\'...
In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published10 Oct 2018
Updated29 Oct 2026
First seen6 Mar 2026
Sources
GHSA-h39x-m55c-v55h · GHSA
CVE-2018-12542 · NVD
Track software like this
Free during beta