CVE-2026-8384

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-8384
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8384.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-8384
Downstream
Published
2026-07-14T08:56:17.525Z
Modified
2026-07-16T03:45:40.328183993Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

In Eclipse Jetty, an HTTP URI of this form:

/public;/../admin/secret.txt

results in an unresolved path of:

/public/../admin/secret.txt

instead of the expected:

/admin/secret.txt

Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).

However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8384.json",
    "cna_assigner": "eclipse",
    "cwe_ids": [
        "CWE-647"
    ]
}
References

Affected packages

Git / github.com/jetty/jetty.project

Affected ranges

Type
GIT
Repo
https://github.com/jetty/jetty.project
Events
Introduced
28100e8da711e44c0722ed10bd413ae862497539
Fixed
ae9286497b46fd709861e330fb364408a946d6e5
Introduced
c8372b65bd15404de1444d68902c0455a3a69b64
Fixed
b1fb145d4b0ea34d7636012359604367f4de7496
Database specific 
{
    "cpe": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.0.35"
        },
        {
            "introduced": "12.1.0"
        },
        {
            "fixed": "12.1.9"
        }
    ]
}

Affected versions

jetty-12.*
jetty-12.0.0x
jetty-12.0.14
jetty-12.0.15
jetty-12.0.19
jetty-12.0.22
jetty-12.0.23
jetty-12.0.30
jetty-12.0.31
jetty-12.0.5
jetty-12.0.6
jetty-12.1.0.beta1
jetty-12.1.2
jetty-12.1.4
jetty-12.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8384.json"