CVE-2026-121489: Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory

Published Nov 4, 2026

Updated

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau.

The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root, anywhere the server process has access.

This issue affects Apache Juneau: through 9.2.0.

Users are recommended to upgrade to version 9.2.1, which fixes the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Juneau to a version that resolves this vulnerability.
Fixed in 9.2.1

Event History

Nov 5, 2026

CVE Published

via MITRE·11:55 AM

Data Sourced

via MITRE·11:55 AM

DescriptionWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Are default Apache Juneau DirectoryResource deployments affected?

The vulnerable view, upload, and delete capabilities are all disabled by default. Exposure requires an application to enable at least one of those DirectoryResource settings.

What access does an attacker need to exploit this issue?

A client can exploit the issue through request paths when an affected DirectoryResource capability is enabled. The impact is limited by the files and directories that the server process itself can access.

What can an attacker do based on the enabled setting?

With view enabled, an attacker can read files outside the configured root directory. With upload or delete enabled, they can write or delete files outside that root, subject to the server process's permissions.

What should organizations do if they cannot upgrade immediately?

Disable DirectoryResource view, upload, and delete settings unless they are required. Restrict the server process permissions to reduce the files an attacker could access, modify, or remove.

Which versions need to be remediated?

Apache Juneau through version 9.2.0 is affected. Upgrade to version 9.2.1, which fixes the issue.

CVE-2026-121489: Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory

Remediation

Event History

Frequently Asked Questions

Are default Apache Juneau DirectoryResource deployments affected?

What access does an attacker need to exploit this issue?

What can an attacker do based on the enabled setting?

What should organizations do if they cannot upgrade immediately?

Which versions need to be remediated?

Company

Resources

Contact

Frequently Asked Questions

Are default Apache Juneau DirectoryResource deployments affected?

What access does an attacker need to exploit this issue?

What can an attacker do based on the enabled setting?

What should organizations do if they cannot upgrade immediately?

Which versions need to be remediated?