CVE-2026-86811: Apache TomEE: Path traversal via stateful EJB passivation
Published Nov 10, 2026
·Updated
The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Affected Software
1 affected component
Apache TomEE<10.3.0, <11.0.0-M2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache TomEEto a version that resolves this vulnerability.Fixed in 10.3.0 - Upgrade
Upgrade
Apache TomEEto a version that resolves this vulnerability.Fixed in 11.0.0-M2
Event History
Nov 10, 2026
CVE Published
via MITRE·02:55 PM
Data Sourced
via MITRE·02:55 PM
DescriptionWeakness
Data Sourced
via NVD·03:17 PM
DescriptionWeakness