Eclipse Vert.x CVE-2025-11966

Exploitation requires THREE specific conditions to all hold: (1) the Vert.x StaticHandler 'directory listing' feature must be explicitly enabled (off by default and generally discouraged in production); (2) the attacker must have the ability to create or rename files/directories within the served path; and (3) a victim must subsequently view the generated directory listing for the stored payload to fire. Limiting factors per the CVSS 4.0 vector: PR:L (some privilege/write access needed), AC:H and AT:P (non-trivial preconditions), and the affected version ranges [4.0.0-4.5.21] and [5.0.0-5.0.4]. These conditions substantially narrow real-world exposure beyond the raw network-reachable framing.

This is a low-priority issue despite being network-reachable. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) yields only 2.3, and the signals are internally consistent: high attack complexity (AC:H), a present attack requirement (AT:P), and required privileges (PR:L) all reflect that exploitation is NOT trivial - an attacker must already be able to create or rename files within the served directory, and the 'directory listing' feature must be explicitly enabled (a non-default, generally discouraged configuration). EPSS is low (0.29%, 20th percentile), consistent with a constrained, condition-dependent stored XSS rather than mass exploitation. Publicly available exploit code exists, but there is NO CISA KEV listing, so POC availability should not be conflated with active exploitation. One caveat: PR:L in the vector implies some authentication, but the underlying 'write access to the served path' could in some deployments come from an unauthenticated upload feature - defenders should verify how files reach the served directory in their own setup. Net: a genuinely low real-world risk that is primarily relevant to the narrow set of deployments running Vert.x with directory listing enabled over an attacker-writable path.

An attacker who can place or rename files in a directory served by Vert.x with directory listing enabled creates a file whose name contains HTML/JavaScript (e.g. embedded in characters that break out of the href/title attributes). When a legitimate user or administrator browses the auto-generated directory listing, the unescaped filename executes as stored XSS in their browser. Publicly available exploit code exists, but exploitation depends on both the directory-listing feature being enabled and the attacker having write/rename access to the served path.