CVE-2026-8384 Details
Description
In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.
A vulnerability in Eclipse Jetty versions 12.0.0 through 12.0.34 and 12.1.0 through 12.1.8 allows for the generation of unresolved paths in HTTP URIs. When a URI containing a path traversal sequence is processed, it results in an unresolved path that includes the traversal sequence, rather than the expected resolved path. While Jetty itself does not serve the 'secret.txt' file due to its alias checking mechanism, web applications that depend on Jetty to provide resolved paths may encounter issues when they receive these unresolved paths instead.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108 | [email protected] | Vendor AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-647 | Use of Non-Canonical URL Paths for Authorization Decisions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| eclipse jetty | >= 12.0.0, < 12.0.35 >= 12.1.0, < 12.1.9 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |