CVE-2026-9083

Katalog CVE

CVSS 4.9 · Medium EPSS 0,78%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada redhat build of keycloak. Skor CVSS 3.1 4.9 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

1 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.9 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:30049 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:30050 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:30083 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2026:30084 advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2026-9083 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2480168 advisory pihak ketiga