CVE record · 1 source
CVE-2026-97881
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories.
- Vendor
- Apache Software Foundation
- Product
- Apache TomEE
- Weakness
- CWE-22
- Exposure class
- Web platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories.
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended…