CLEANSTART-2026-TK06173: In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context
Published Nov 13, 2026
·Updated
Security vulnerability affects the rundeck package. In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context.
Affected Software
1 affected componentFixes available
cleanstart/rundeck<6.0.1-r11
6.0.1-r11
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11
Event History
Nov 13, 2026
Advisory Published
via OSV·12:36 AM
Data Sourced
via OSV·12:36 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What configuration condition is required for this issue to be relevant?
The issue is relevant when Eclipse Jetty's TryPathsHandler or TryFilesFilter is configured to forward requests to a template URI that incorporates the request path in context, such as `index?p=$path`.
2
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network reachability with low attack complexity and no required privileges or user interaction.