CVE-2026-114370
LOW 3.7A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 25th percentile
Impact if exploited
3.7CVSS 3.1 · LOW
- ConfidentialityLow
- IntegrityNone
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Affected
Vendors Red Hat
Products Red Hat Build Of Apache Camel For Spring Boot 4 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Fuse 7 Red Hat Jboss Enterprise Application Platform 7 Red Hat Jboss Enterprise Application Platform 8 Red Hat Jboss Enterprise Application Platform Expansion Pack Red Hat Single Sign On 7
Weakness (CWE)
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References and research data (JSON)
Vendor product assessments
undertow-servlet as a component of Red Hat build of Apache Camel for Spring Boot 4 · known affected
Vendor assessment for this product only.
pkg:maven/io.undertow/undertow-servlet
- none available: Affected
jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 as a component of Red Hat JBoss Enterprise Application Platform 7 · known affected
Vendor assessment for this product only.
pkg:oci/eap74-els-openjdk11-openshift-rhel8?repository_url=registry.redhat.io/jboss-eap-7/eap74-els-openjdk11-openshift-rhel8
- none available: Fix deferred
jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 as a component of Red Hat JBoss Enterprise Application Platform 7 · known affected
Vendor assessment for this product only.
pkg:oci/eap74-els-openjdk17-openshift-rhel8?repository_url=registry.redhat.io/jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
- none available: Fix deferred
jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 as a component of Red Hat JBoss Enterprise Application Platform 7 · known affected
Vendor assessment for this product only.
pkg:oci/eap74-els-openjdk8-openshift-rhel8?repository_url=registry.redhat.io/jboss-eap-7/eap74-els-openjdk8-openshift-rhel8
- none available: Fix deferred
undertow-servlet as a component of Red Hat JBoss Enterprise Application Platform 7 · known affected
Vendor assessment for this product only.
pkg:maven/io.undertow/undertow-servlet
- none available: Fix deferred
undertow-servlet as a component of Red Hat JBoss Enterprise Application Platform 8 · known affected
Vendor assessment for this product only.
pkg:maven/io.undertow/undertow-servlet
- none available: Affected
undertow-servlet as a component of Red Hat Single Sign-On 7 · known affected
Vendor assessment for this product only.
pkg:maven/io.undertow/undertow-servlet
- none available: Affected
undertow-servlet as a component of Red Hat Fuse 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code cannot be controlled by adversary
pkg:maven/io.undertow/undertow-servlet
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00undertow-servlet as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack · known not affected
Vendor assessment for this product only.
Reason: component not present
pkg:maven/io.undertow/undertow-servlet
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00resteasy-javadoc (pki-core:10.6) as a component of Red Hat Enterprise Linux 8 · under investigation
Vendor assessment for this product only.
pkg:rpm/redhat/resteasy-javadoc?rpmmod=pki-core:10.6
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00resteasy-javadoc (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8 · under investigation
Vendor assessment for this product only.
pkg:rpm/redhat/resteasy-javadoc?rpmmod=pki-deps:10.6
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00resteasy.src (pki-core:10.6) as a component of Red Hat Enterprise Linux 8 · under investigation
Vendor assessment for this product only.
pkg:rpm/redhat/resteasy?arch=src&rpmmod=pki-core:10.6
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00resteasy.src (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8 · under investigation
Vendor assessment for this product only.
pkg:rpm/redhat/resteasy?arch=src&rpmmod=pki-deps:10.6
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00resteasy (pki-core:10.6) as a component of Red Hat Enterprise Linux 8 · under investigation
Vendor assessment for this product only.
pkg:rpm/redhat/resteasy?rpmmod=pki-core:10.6
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00resteasy (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8 · under investigation
Vendor assessment for this product only.
pkg:rpm/redhat/resteasy?rpmmod=pki-deps:10.6
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00pki-resteasy-client as a component of Red Hat Enterprise Linux 9 · under investigation
Vendor assessment for this product only.
pkg:rpm/redhat/pki-resteasy-client
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00pki-resteasy-core as a component of Red Hat Enterprise Linux 9 · under investigation
Vendor assessment for this product only.
pkg:rpm/redhat/pki-resteasy-core
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00pki-resteasy-jackson2-provider as a component of Red Hat Enterprise Linux 9 · under investigation
Vendor assessment for this product only.
pkg:rpm/redhat/pki-resteasy-jackson2-provider
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00pki-resteasy-servlet-initializer as a component of Red Hat Enterprise Linux 9 · under investigation
Vendor assessment for this product only.
pkg:rpm/redhat/pki-resteasy-servlet-initializer
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00resteasy.src as a component of Red Hat Enterprise Linux 9 · under investigation
Vendor assessment for this product only.
pkg:rpm/redhat/resteasy?arch=src
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00
All CVSS metrics
- LOW 3.7 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - LOW 3.7 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114370.json Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107307 EUVD · EUVD-2026-107307
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-114370 CVE record · redhat · Updated 2026-10-21T15:02:10.807Z
NVD · CVE-2026-114370 · Updated 2026-10-22T15:25:35.333
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00 - https://bugzilla.redhat.com/show_bug.cgi?id=2528757 CVE record · redhat · Updated 2026-10-21T15:02:10.807Z
NVD · CVE-2026-114370 · Updated 2026-10-22T15:25:35.333
Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00 - https://www.cve.org/CVERecord?id=CVE-2026-114370 Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-114370 Red Hat · CVE-2026-114370 · Updated 2026-10-21T17:54:53+00:00