Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-13503: ANTLR4 Path Traversal Vulnerability in TokenVocab Handler
CVE-2026-13503
Summary
A vulnerability in ANTLR4's TokenVocab Handler allows an attacker to access files on the system by manipulating file paths. This can happen remotely, and the exploit is now publicly available. Update to a fixed version of ANTLR4 to protect your system.
Original title
A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component...
Original description
A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
nvd CVSS2.0
5.0
nvd CVSS3.1
5.3
nvd CVSS4.0
5.5
Vulnerability type
CWE-22
Path Traversal
Published: 28 Jun 2026 · Updated: 23 Jul 2026 · First seen: 28 Jun 2026