CVE-2026-114370Low· 3.7▾ SunlitA flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link point…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory.
undertow-servlet (all versions)pki-core:10.6/resteasypki-deps:10.6/resteasyresteasyundertow-servletjboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)undertow-servlet (all versions)undertow-servlet (all versions)undertow-servletundertow-servlet (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55888High· 8.2xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames (CVE-2026-55888)
CVE-2026-115354Medium· 6.5mistune: mistune: Information disclosure via path traversal in Include directive (CVE-2026-115354)
CVE-2026-115207Medium· 5.5Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2026-85518Medium· 6.1Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition
CVE-2026-114126High· 8.8storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token (CVE-2026-114126)