Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-121489— Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory

Quick assessment

Affected

Apache Software Foundation Apache Juneau

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Juneau 中存在“路径名未限制在受限目录内”（即“路径遍历”）漏洞。该微服务中的 DirectoryResource 组件未能将请求路径限制在其配置的根目录内。当应用程序启用了该资源的视图（view）、上传（upload）或删除（delete）功能（这些功能默认均为关闭状态）时，客户端即可在服务器进程有权访问的任何位置，读取、写入或删除根目录之外的文件。此漏洞影响 Apache Juneau 9.2.0 及以下的所有版本。建议用户升级至已修复该问题的 9.2.1 版本。

CVSS 10.0 · Critical Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1583.006 · Web Services

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory

Source: CVE Program / CVE List V5

Vulnerability Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access. This issue affects Apache Juneau: through 9.2.0. Users are recommended to upgrade to version 9.2.1, which fixes the issue.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache Juneau	0 ~ 9.2.1	-
Apache Software Foundation	Apache Juneau	0 ~ 9.2.1	-

II. Public POCs for CVE-2026-121489

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121489

请登录查看更多情报信息。

Other References for CVE-2026-121489 (1)

https://lists.apache.org/thread.html/j05q7vw08j48o96tdlzcsd4sozx1lyl6 vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121489

Same Patch Batch · Apache Software Foundation · 2026-11-05 · 58 CVEs total

CVE-2026-73098	10.0 CRITICAL	Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during pa
CVE-2026-73099	10.0 CRITICAL	Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body
CVE-2026-73100	10.0 CRITICAL	Apache Juneau: Sensitive request headers logged in cleartext by the default request logger
CVE-2026-73101	10.0 CRITICAL	Apache Juneau: Internal exception class and message disclosed via error response header an
CVE-2026-73116	10.0 CRITICAL	Apache Juneau: REST client forwards credentials to a different origin when following HTTP
CVE-2026-73117	10.0 CRITICAL	Apache Juneau: Response header CRLF injection and open redirect when applications set head
CVE-2026-96677	10.0 CRITICAL	Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
CVE-2026-73095	8.7 HIGH	Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST reque
CVE-2026-103864		Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
CVE-2026-97355		Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Servi
CVE-2026-109856		Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Bal
CVE-2026-109837		Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cr
CVE-2026-109129		Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Un
CVE-2026-105461		Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify o
CVE-2026-105330		Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unau
CVE-2026-105325		Apache OFBiz: Missing authorization in payment application services allows view-only users
CVE-2026-100228		Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price
CVE-2026-100168		Apache OFBiz: Missing Authorization vulnerability
CVE-2026-97356		Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypas
CVE-2026-92887		Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitt

Showing top 20 of 58 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache Juneau

Same vendor: Apache Software Foundation

Same weakness: CWE-22