CVE-2026-8384CWE-647

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path…

Medium · published July 14, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
24.9
In the wild
Unconfirmed
What it is

In Eclipse Jetty, an HTTP URI of this form:

/public;/../admin/secret.txt

results in an unresolved path of:

/public/../admin/secret.txt

instead of the expected:

/admin/secret.txt

Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).

However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00330 · 24.9th percentile
Weakness
CWE-647 · Use of Non-Canonical URL Paths for Authorization Decisions
Published
2026-07-14T08:56Z
EPSS history
Timeline
  • 14 JUL 08:56Z
    In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path…
    cvelistv5