CVE-2026-8384 — Eclipse Foundation / Eclipse Jetty

Description (CNA)

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

Affected (CNA)

Vendor / product	Versions
Eclipse Foundation / Eclipse Jetty	affected 12.0.0 through 12.0.34; affected 12.1.0 through 12.1.8

CWE

CWE-647

References

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.