The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories.
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Apache Software Foundation
- Product
- Apache TomEE
- Weakness
- CWE-22
- Exposure class
- Web platform
- NVD status
- Received
Why it ranks 20 (Routine)
- Product class: web platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-97881 on this site · NVD · CVE.org · Vulnpedia