CVE-2026-24457

Katalog CVE

CVSS 9.8 · Critical EPSS 0,64%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada eclipse openmq. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved. This is fixed in OpenMQ 6.5.2, 6.9.0, and in GlassFish 7.0.26, 7.1.1, and 8.0.2.

Rincian

Terbit di NVD

5 Maret 2026

Terakhir diubah

5 Agustus 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-27: Path Traversal: 'dir/../../filename'

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.eclipse.org/security/cve-assignment/-/issues/84 advisory vendor