{"id":"CVE-2026-111258","kind":"vulnerability","aliases":["CVE-2026-111258"],"related":[],"title":"Optional request routing bypasses access controls, exposing protected application files","description":"The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories. If a route copies client-controlled parts of the request path into its destination, a remote attacker can reach protected resources or read application configuration and class files. Only installations with such a routing configuration are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"An optional request routing feature forwards requests to their destination without applying that destination's security constraints or the protection of private directories. A remote attacker can reach protected resources or read application configuration and class files.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","request-routing","web-server"],"not_affected_if":["default-config","no-routing-configuration"],"how_to_check":"- Look for a routing or rewrite configuration that copies client-controlled parts of the request path into a destination.\n- Check the product and version in use against the fixed versions named below; the sources do not name the product.","fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, the versions the sources name as fixed.","status":"open","published_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:24:10+00:00","updated_at":"2026-11-10T16:24:10+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T16:24:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `10.3.0` or `11.0.0-M2`, the versions the sources name as fixed.","reach":"internet","title":"Optional request routing bypasses access controls, exposing protected application files","impact":"medium","summary":"An optional request routing feature forwards requests to their destination without applying that destination's security constraints or the protection of private directories. A remote attacker can reach protected resources or read application configuration and class files.","audience":"businesses","category":"other","nicknames":[],"who_cares":["web-server","request-routing"],"confidence":0.5,"fix_status":"available","needs_auth":"no","worst_case":"Remote attackers read config and class files or reach protected resources","analyst_note":"Identify the product named by the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111258 and confirm the affected version ranges.","how_to_check":"- Look for a routing or rewrite configuration that copies client-controlled parts of the request path into a destination.\n- Check the product and version in use against the fixed versions named below; the sources do not name the product.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-routing-configuration","default-config"],"who_is_affected":"Only installations that use the optional request routing feature with a configuration that copies client-controlled request path segments into a destination are affected. Servers without such a routing configuration are not affected according to the sources. The sources do not name the product.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001081,"input_tokens":4575,"output_tokens":1248,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111258':13A,16A '-2026':12A,15A '10.3.0':135C '11.0.0':137C 'access':5A 'affect':127C 'appli':35B,73C 'applic':9A,56B,86C,114C 'attack':49B,107C 'bypass':4A 'class':59B,117C 'client':95C 'client-control':94C 'configur':57B,70C,115C,125C 'constraint':40B,76C 'control':6A,96C 'copi':93C 'cve':11A,14A 'destin':33B,37B,71C,79C,104C 'directori':46B,89C 'expos':7A 'featur':28B,65C 'file':10A,60B,118C 'fix':140C 'forward':29B,66C 'instal':120C 'issu':142C 'm2':138C 'option':1A,25B,62C 'part':97C 'path':101C 'privat':45B,88C 'protect':8A,43B,52B,82C,110C 'reach':51B,109C 'read':55B,113C 'recommend':130C 'remot':48B,106C 'request':2A,19B,26B,30B,63C,67C,100C 'request-rout':18B 'resourc':53B,111C 'rout':3A,20B,27B,64C,92C,124C 'secur':39B,75C 'server':23B 'upgrad':132C 'user':128C 'version':134C 'web':22B,85C 'web-serv':21B 'without':34B,72C","nicknames":[],"mitigations":[],"who_affected":"Only installations that use the optional request routing feature with a configuration that copies client-controlled request path segments into a destination are affected. Servers without such a routing configuration are not affected according to the sources. The sources do not name the product.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["other","requestrouting","unknown","webserver"],"campaign_type":null,"search_a":"'-111258':13A,16A '-2026':12A,15A 'access':5A 'applic':9A 'bypass':4A 'control':6A 'cve':11A,14A 'expos':7A 'file':10A 'option':1A 'protect':8A 'request':2A 'rout':3A","search_b":"'appli':35B 'applic':56B 'attack':49B 'class':59B 'configur':57B 'constraint':40B 'destin':33B,37B 'directori':46B 'featur':28B 'file':60B 'forward':29B 'option':25B 'privat':45B 'protect':43B,52B 'reach':51B 'read':55B 'remot':48B 'request':19B,26B,30B 'request-rout':18B 'resourc':53B 'rout':20B,27B 'secur':39B 'server':23B 'web':22B 'web-serv':21B 'without':34B","search_c":"'10.3.0':135C '11.0.0':137C 'affect':127C 'appli':73C 'applic':86C,114C 'attack':107C 'class':117C 'client':95C 'client-control':94C 'configur':70C,115C,125C 'constraint':76C 'control':96C 'copi':93C 'destin':71C,79C,104C 'directori':89C 'featur':65C 'file':118C 'fix':140C 'forward':66C 'instal':120C 'issu':142C 'm2':138C 'option':62C 'part':97C 'path':101C 'privat':88C 'protect':82C,110C 'reach':109C 'read':113C 'recommend':130C 'remot':106C 'request':63C,67C,100C 'resourc':111C 'rout':64C,92C,124C 'secur':75C 'upgrad':132C 'user':128C 'version':134C 'web':85C 'without':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111258","severity":null,"published_at":"2026-11-10T16:17:16+00:00","modified_at":"2026-11-10T16:17:16+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}