Apache Juneau CVE-2026-121489

Exploitation requires that the application expose the Juneau microservice DirectoryResource (juneau-microservice-core) to untrusted clients AND that at least one of allowViews, allowDeletes, or allowUploads be explicitly enabled - all three are off by default, so default deployments are not affected. Given those prerequisites, an unauthenticated client can exploit it by sending a request path containing parent-directory (../) segments; no user interaction or credentials are needed. The limiting factors are therefore the non-default configuration and whether the resource is reachable, and the achievable impact (read vs. delete vs. write) is bounded by which specific flag(s) the operator enabled and by the server process's filesystem permissions.

No CVSS vector, EPSS score, KEV entry, or PoC reference is provided for CVE-2026-121489, and vuln.today's decision label is 'awaiting_data', so this assessment rests on the Apache advisory text alone. The vendor rates it 'moderate', and the decisive mitigating factor stated by the advisory is that the enabling settings (allowViews, allowDeletes, allowUploads) are OFF by default - only applications that deliberately expose a Juneau microservice DirectoryResource with one of these flags enabled are exploitable, which sharply narrows the real-world population. Where it IS exploitable, the mechanism (path building from the request path without verifying the result stays under the configured root) is a classic directory traversal that an unauthenticated client can trigger, and impact can escalate from file disclosure to arbitrary deletion or write depending on which flags are set. There is no evidence of active exploitation and no public exploit was identified at time of analysis; combined with the off-by-default requirement and Juneau's modest deployment footprint, this is a real but conditional issue rather than a widespread emergency. Exploitation status, EPSS, and any PoC are MISSING from the input and should be treated as unknown, not as zero.

An application exposes a Juneau microservice DirectoryResource to the network with allowViews (or allowDeletes/allowUploads) enabled. An unauthenticated attacker sends a request whose path contains parent-directory (../) segments; because the resource does not confine the resolved path to the configured root, the server reads, deletes, or writes a file outside that root wherever the process has filesystem access. No public exploit was identified at time of analysis.