Eclipse Jetty Unresolved Path Directory Traversal via HTTP URI
CVE-2026-8384 Published on July 14, 2026
In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.
Vulnerability Analysis
CVE-2026-8384 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
Use of Non-Canonical URL Paths for Authorization Decisions
The software defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
Products Associated with CVE-2026-8384
Want to know whenever a new CVE is published for Eclipse Jetty? stack.watch will email you.
Affected Versions
Eclipse Foundation Eclipse Jetty:- Version 12.0.0, <= 12.0.34 is affected.
- Version 12.1.0, <= 12.1.8 is affected.