CVE-2026-93649
- Source
- https://cve.org/CVERecord?id=CVE-2026-93649
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93649.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-93649
- Aliases
-
- GHSA-f228-m952-5r6w
- Published
- 2026-10-15T13:28:42Z
- Modified
- 2026-10-17T10:45:40Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta http-equiv="refresh". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine "Thank you for downloading Eclipse Temurin" page while their browser downloads a binary of the attacker's choosing
- Database specific
{ "cna_assigner": "eclipse", "cwe_ids": [ "CWE-494", "CWE-601" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93649.json", "unresolved_ranges": [ { "extracted_events": [ { "fixed": "1f9753c" } ], "source": "AFFECTED_FIELD" } ] }- References
-
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/313
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93649.json
- https://github.com/adoptium/adoptium.net/security/advisories/GHSA-f228-m952-5r6w#event-1046947
- https://nvd.nist.gov/vuln/detail/CVE-2026-93649
- https://github.com/adoptium/adoptium.net/commit/cbb53cf4a41f068a70902217473d7e2fe5d6c6ad