CVE-2026-121489

{
  "etk_id": "ETK-2026-3630",
  "cve_id": "CVE-2026-121489",
  "display_id": "CVE-2026-121489",
  "ghsa_id": "GHSA-6jw3-6826-3jf9",
  "euvd_id": "EUVD-2026-117414",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Path traversal in Apache Juneau DirectoryResource",
  "summary": "Apache Juneau through 9.2.0 can allow DirectoryResource requests to escape the configured directory. An attacker may access, alter, or remove files permitted to the server process when the resource's view, upload, or delete operations are enabled.",
  "mitigation": "Upgrade Apache Juneau to version 9.2.1. Until upgraded, disable DirectoryResource view, upload, and delete operations where they are not required.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Juneau",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 9.2.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "9.2.1"
      ],
      "package_name": "org.apache.juneau:juneau-microservice-core",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 9.2.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "9.2.1"
      ],
      "package_name": "org.apache.juneau:juneau-commons",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.338690983333333,
  "t0_at": "2026-11-05T11:55:23.820000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-05T11:55:23.820000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T11:55:23.820000+00:00",
      "url": "https://github.com/advisories/GHSA-6jw3-6826-3jf9"
    }
  }
}