---
id: "CVE-2026-111258"
page: "https://infrastack.ai/live/CVE-2026-111258"
kind: "vulnerability"
aliases: ["CVE-2026-111258"]
title: "Optional request routing bypasses access controls, exposing protected application files"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "request-routing", "web-server"]
not_affected_if: ["default-config", "no-routing-configuration"]
published_at: "2026-11-10T16:17:16+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:24:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111258", "first_seen_at": "2026-11-10T16:22:33+00:00"}]
exploit_sources: []
---

# Optional request routing bypasses access controls, exposing protected application files

Link for people: https://infrastack.ai/live/CVE-2026-111258 (this .md is for agents)

An optional request routing feature forwards requests to their destination without applying that destination's security constraints or the protection of private directories. A remote attacker can reach protected resources or read application configuration and class files.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for a routing or rewrite configuration that copies client-controlled parts of the request path into a destination.
- Check the product and version in use against the fixed versions named below; the sources do not name the product.

## Fix

- Upgrade to `10.3.0` or `11.0.0-M2`, the versions the sources name as fixed.

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111258

## From the sources

The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories. If a route copies client-controlled parts of the request path into its destination, a remote attacker can reach protected resources or read application configuration and class files. Only installations with such a routing configuration are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_