Skip to main content
MEDIUM

CVE-2026-8384

CVSS v3

5.3

MEDIUM

EPSS Score

0.3 %

exploit probability, as of 2026-10-02

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Description

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path

Technical details

Published
2026-07-14
Last Modified
2026-07-14
GitHub Advisory
GHSA-w7x5-g22v-xqhr

Frequently asked questions

What is CVE-2026-8384?

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path

Is CVE-2026-8384 actively exploited?

Active exploitation of CVE-2026-8384 has not been confirmed. Its EPSS score was 0.3% on 2026-10-02, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-8384?

CVE-2026-8384 has a CVSS v3 base score of 5.3 (MEDIUM severity).

Is CVE-2026-8384 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEsSIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2026 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database