CVE-2026-8384

{
  "id": "CVE-2026-8384",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-14T09:16:42.050",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path."
    },
    {
      "lang": "es",
      "value": "En Eclipse Jetty, una URI HTTP de esta forma:\n\n/public;/.. / admin/secret.txt\n\nresulta en una ruta no resuelta de:\n\n/public/.. / admin/secret.txt\n\nen lugar de la esperada:\n\n/admin/secret.txt\n\nJetty en sí no se ve afectado, ya que no servirá el archivo secret.txt porque no pasará el verificador de alias (solo se sirven recursos resueltos).\n\nSin embargo, las aplicaciones web que dependen de que Jetty proporcione rutas resueltas pueden confundirse al recibir una ruta no resuelta."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Eclipse Foundation",
          "product": "Eclipse Jetty",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/jetty/jetty.project",
          "versions": [
            {
              "version": "12.0.0",
              "lessThanOrEqual": "12.0.34",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "12.1.0",
              "lessThanOrEqual": "12.1.8",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-14T12:18:08.648859Z",
          "id": "CVE-2026-8384",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-647"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "12.0.0",
              "versionEndExcluding": "12.0.35",
              "matchCriteriaId": "655AA819-8D55-40C7-BCF3-F7D2AC085C41"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "12.1.0",
              "versionEndExcluding": "12.1.9",
              "matchCriteriaId": "FF2AE57E-99D5-4181-A5B6-77A5FFBEB3F1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory",
        "Exploit"
      ]
    }
  ]
}