Live › vulnerability › CVE-2026-114370
Go to dashboardUndertow's PathResourceManager, which serves static files, checks symbolic link targets by string prefix rather than full directory name. An attacker can read files in a sibling directory whose name starts with the same characters as an allowed directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications running Undertow that serve static files from disk through PathResourceManager and that contain symbolic links pointing into a directory whose name shares a prefix with an allowed one. Deployments that serve no files from disk, or that have no symlinks in served directories, are less exposed. The sources do not give affected versions.
No product ranges from the sources yet.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-114370")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.