{"id":"CVE-2026-121489","kind":"vulnerability","aliases":["CVE-2026-121489"],"related":[],"title":"Apache Juneau: path traversal in DirectoryResource lets requests reach files outside root","description":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau.\n\nThe microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access.\n\nThis issue affects Apache Juneau: through 9.2.0.\n\nUsers are recommended to upgrade to version 9.2.1, which fixes the issue.","summary":"Apache Juneau's DirectoryResource microservice does not keep request paths inside its configured root directory. When view, upload or delete settings are enabled, a client can read, write or delete any file the server process can access.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-juneau","java","microservice","package"],"not_affected_if":["default-config","resource-not-used"],"how_to_check":"- Check the Apache Juneau version in the project's dependency file; affected versions are through `9.2.0`.\n- Search the code for `DirectoryResource` and check whether its view, upload or delete settings are enabled.","fix":"- Apache Juneau: upgrade to `9.2.1`.","status":"open","published_at":"2026-11-05T12:17:49+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","triaged_at":"2026-11-05T12:40:05+00:00","updated_at":"2026-11-05T12:40:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T12:40:05Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Juneau: upgrade to `9.2.1`.","reach":"internet","title":"Apache Juneau: path traversal in DirectoryResource lets requests reach files outside root","impact":"high","summary":"Apache Juneau's DirectoryResource microservice does not keep request paths inside its configured root directory. When view, upload or delete settings are enabled, a client can read, write or delete any file the server process can access.","audience":"developers","category":"package","nicknames":[],"who_cares":["apache-juneau","java","microservice"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads, writes or deletes arbitrary server files","analyst_note":"Confirm whether DirectoryResource requests need authentication and whether the NVD entry lists other affected version ranges.","how_to_check":"- Check the Apache Juneau version in the project's dependency file; affected versions are through `9.2.0`.\n- Search the code for `DirectoryResource` and check whether its view, upload or delete settings are enabled.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","resource-not-used"],"who_is_affected":"Applications built on Apache Juneau that expose the DirectoryResource microservice with its view, upload or delete settings turned on, which are off by default. Applications that do not use DirectoryResource, or keep those settings off, are not exposed by this description. The sources do not say whether the flaw is reachable without authentication.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000706,"input_tokens":4305,"output_tokens":551,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-121489':15A,18A '-2026':14A,17A '9.2.0':129C '9.2.1':137C 'access':61B,122C 'affect':125C 'anywher':117C 'apach':1A,20B,25B,75C,126C 'apache-juneau':19B 'applic':92C 'client':49B,107C 'configur':37B,87C 'cve':13A,16A 'default':105C 'delet':44B,54B,100C,112C 'directori':39B,70C,89C 'directoryresourc':6A,28B,79C 'enabl':47B,93C 'file':10A,56B,113C 'fix':139C 'improp':62C 'insid':35B,85C 'issu':124C,141C 'java':22B 'juneau':2A,21B,26B,76C,127C 'keep':32B,82C 'let':7A 'limit':63C 'microservic':23B,29B,78C 'outsid':11A,114C 'packag':24B 'path':3A,34B,71C,84C 'pathnam':66C 'process':59B,120C 'reach':9A 'read':51B,109C 'recommend':132C 'request':8A,33B,83C 'resourc':95C 'restrict':69C 'root':12A,38B,88C,116C 'server':58B,119C 'set':45B,101C 'travers':4A,72C 'upgrad':134C 'upload':42B,98C 'user':130C 'version':136C 'view':41B,97C 'vulner':73C 'write':52B,110C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Apache Juneau that expose the DirectoryResource microservice with its view, upload or delete settings turned on, which are off by default. Applications that do not use DirectoryResource, or keep those settings off, are not exposed by this description. The sources do not say whether the flaw is reachable without authentication.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachejuneau","critical","java","microservice","package"],"campaign_type":null,"first_public_at":"2026-11-05T12:17:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121489","severity":null,"published_at":"2026-11-05T12:17:49+00:00","modified_at":"2026-11-05T12:17:49+00:00","first_seen_at":"2026-11-05T12:38:47+00:00","fetched_at":"2026-11-05T12:38:47+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}