Loading vulnerability…
Path Traversal in Apache Juneau DirectoryResource
CVE-2026-121489 is a path traversal vulnerability in Apache Juneau's microservice DirectoryResource, affecting juneau-microservice-core and juneau-commons through version 9.2.0. DirectoryResource builds filesystem paths from request paths without ensuring that they remain within its configured root directory. When allowViews, allowUploads, or allowDeletes is enabled, a client can use parent-directory traversal segments to perform the corresponding file operations outside that root, subject to the server process's filesystem permissions. All three settings are disabled by default.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality through unauthorized file reads, integrity through unauthorized file creation or modification, and availability through file deletion or damage. The accessible files and permitted operations depend on the enabled DirectoryResource settings and the server process's filesystem permissions.
If you can’t patch tonight, do this now.
Until upgrading, disable DirectoryResource's allowViews, allowUploads, and allowDeletes settings, or prevent untrusted clients from accessing the resource. Restrict the server process's filesystem permissions to limit the files accessible through exploitation.
Patch, then assume compromise.
Upgrade Apache Juneau to version 9.2.1, including juneau-microservice-core, juneau-commons, and any shaded or aggregate artifacts embedding the affected modules. Version 9.2.1 validates resolved paths against the configured root directory and rejects escaping paths with HTTP 403 Forbidden.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.