CVE-2014-7816
redhat undertow: no CVSS score yet. EPSS 25% chance of exploitation in the next 30 days. Fixed in io.undertow:undertow-core 1.0.17, 1.1.0.CR5, 1.2.0.Beta3.
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.
- EPSS
- 25% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:undertow
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h6p6-fc4w-cqhx | Maven | io.undertow:undertow-core | >=1.0.0 <1.0.17 | 1.0.17 |
| GHSA-h6p6-fc4w-cqhx | Maven | io.undertow:undertow-core | >=1.1.0.Beta1 <1.1.0.CR5 | 1.1.0.CR5 |
| GHSA-h6p6-fc4w-cqhx | Maven | io.undertow:undertow-core | >=1.2.0.Beta1 <1.2.0.Beta3 | 1.2.0.Beta3 |