Eclipse Vert.x CVE-2025-11965

Exploitation requires the target application to use Eclipse Vert.x's web StaticHandler to serve static content with the hidden-file restriction feature relied upon for security, AND a hidden directory (e.g. '.git', '.svn', or similar dot-prefixed directory) containing sensitive files to exist within the directory root served by that handler. The restriction correctly blocks hidden files at the top level but not files nested inside hidden directories. Limiting factors: if no sensitive hidden directory is present in the served root, or if the application does not use StaticHandler for static assets, there is nothing to disclose; the flaw only affects the listed version ranges (4.0.0-4.5.21 and 5.0.0-5.0.4). No authentication or user interaction is needed (PR:N/UI:N), but the AT:P attack requirement reflects this deployment dependency.

This is a medium-severity information-disclosure flaw (vendor CVSS 4.0 base 6.3) where Eclipse Vert.x's StaticHandler, when configured to block hidden files, still serves files located inside hidden directories such as '.git', exposing source-control metadata, credentials, or configuration. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) indicates remote, unauthenticated, low-complexity access but with an explicit Attack Requirement (AT:P) - meaning exploitation depends on the target's deployment (a hidden directory must actually exist within the served web root). Impact is limited: VC:L/VI:L/VA:N (low confidentiality and integrity, no availability), consistent with CWE-552 (Files or Directories Accessible to External Parties). EPSS is low at 0.50% (41st percentile), there is no CISA KEV listing, and no public exploit is identified in the provided data, so the real-world urgency is modest rather than emergency-grade. The practical caveat: while the access vector is trivially remote and unauthenticated, actual value to an attacker hinges entirely on whether sensitive hidden directories (e.g. '.git') are present in the static root - absent that, the finding is largely academic. Net assessment: a legitimate but patch-on-normal-cadence issue, not a drop-everything priority.

An attacker browsing a web application built on Vert.x that serves static assets via StaticHandler (with hidden-file restriction enabled) requests a path inside a hidden directory, e.g. GET /.git/config, and receives the file despite the configured restriction. No authentication or user interaction is required, and from '.git' metadata the attacker can reconstruct source code, internal paths, or leaked secrets. No public proof-of-concept is referenced in the provided data.