Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Apache Juneau allows reading files outside its root directory

CVE-2026-121489 · published 4 days ago
Summary

Apache Juneau versions up to 9.2.0 let a specially crafted request reach files beyond the folder it is supposed to protect. This could let an attacker view, add, or delete any file the server can access. Upgrade to Apache Juneau 9.2.1 to stop the problem.

What to do
  • Update apache software foundation apache juneau to version 9.2.1 or later.
Affected software
VendorProductAffected versions
apache software foundation apache juneau < 9.2.1
Original advisory text
Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau.

The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published5 Nov 2026
Updated6 Nov 2026
First seen5 Nov 2026
Sources
CVE-2026-121489 · NVD
CVE-2026-121489 · MITRE
Track software like this
Free during beta