Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54617— GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler

Quick assessment

Affected
GravitLauncher Launcher
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GravitLauncher 是一个基于 sashok724 的 v3 版本开发的开源 Minecraft 启动器。在 5.7.12 版本之前，未经身份验证的远程攻击者可以向默认运行在 9274 端口的 LaunchServer 文件服务器发送以原始 HTTP 请求目标形式且不以斜杠（/）开头的请求。 中的 会移除请求目标的第一个字符，并将剩余的路径相对于 进行解析，但不会重新进行规范化（normalization）并验证路径是否在目录包含范围内（containment）。这使得在缺少前导斜杠的请求中保留父目录组件

CVSS 9.8 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
GravitLauncher Launcher < 5.7.12 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54617

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler
Source: CVE Program / CVE List V5
Vulnerability Description
GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in components/launchserver/src/main/java/pro/gravit/launchserver/socket/handlers/fileserver/FileServerHandler.java strips the first request-target character and resolves the remaining path against updatesDir without re-normalizing and verifying containment. This leaves parent-directory components in a no-leading-slash request and allows reading any file accessible to the LaunchServer process, including .keys/ecdsa_id, .keys/legacySalt, and LaunchServer.json. Disclosure of those files can expose signing keys, refresh-token material, and database credentials, enabling forged administrative access tokens and full authentication bypass. A normalizing L7 proxy may block the primary request form, but direct exposure and L4/TCP proxies remain affected, and netty.fileServerEnabled is enabled by default. This issue is fixed in 5.7.12.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
GravitLauncher Launcher < 5.7.12 -

II. Public POCs for CVE-2026-54617

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54617

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54617 (1)

Vendor Advisories for CVE-2026-54617 (1)

Vendor Pages for CVE-2026-54617 (1)

IV. Related Vulnerabilities

Same product: Launcher
Same weakness: CWE-22

V. Comments for CVE-2026-54617

No comments yet

Leave a comment