---
id: "CVE-2026-121489"
kind: "vulnerability"
aliases: ["CVE-2026-121489"]
title: "Apache Juneau: path traversal in DirectoryResource lets requests reach files outside root"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-juneau", "java", "microservice", "package"]
not_affected_if: ["default-config", "resource-not-used"]
published_at: "2026-11-05T12:17:49+00:00"
first_seen_at: "2026-11-05T12:38:47+00:00"
updated_at: "2026-11-05T12:40:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121489", "first_seen_at": "2026-11-05T12:38:47+00:00"}]
exploit_sources: []
---

# Apache Juneau: path traversal in DirectoryResource lets requests reach files outside root

Apache Juneau's DirectoryResource microservice does not keep request paths inside its configured root directory. When view, upload or delete settings are enabled, a client can read, write or delete any file the server process can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Apache Juneau version in the project's dependency file; affected versions are through `9.2.0`.
- Search the code for `DirectoryResource` and check whether its view, upload or delete settings are enabled.

## Fix

- Apache Juneau: upgrade to `9.2.1`.

## Timeline

- 2026-11-05T12:38:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121489

## From the sources

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau.

The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_