EUVD-2026-39397
GHSA-qf2j-8858-jvcv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated single-request file read over the network (AV:N/AC:L/PR:N/UI:N); high confidentiality disclosure with no integrity or availability impact and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the configured webroot. Attackers can traverse outside the webroot directory using traversal-prefixed paths in a single HTTP request to read any file accessible to the servlet engine process, including sensitive system files when the service runs with elevated privileges.
AnalysisAI
Arbitrary file read in Winstone Servlet Engine (versions through 0.9.10) lets unauthenticated remote attackers retrieve any file readable by the servlet process by embedding dot-dot-slash sequences in HTTP GET request paths to the static-file handler. The flaw stems from missing path sanitization when resolving requests against the configured webroot, and publicly available exploit code exists (reported by VulnCheck), though it is not listed in CISA KEV. Impact is confidentiality-only but high, escalating to disclosure of OS-level secrets when the engine runs with elevated privileges.
Technical ContextAI
Winstone is a small, standalone Java servlet container originally authored by Rick Knowles (CPE cpe:2.3:a:rickknowles:winstone_servlet_container) and historically embedded in other Java tooling as a lightweight HTTP/servlet engine. The vulnerability is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the static-file servlet concatenates the request URI to the webroot path without canonicalizing or rejecting '../' segments, so a request path can resolve to files outside the intended document root. Because the resolution happens before any access check, the engine returns whatever file the JVM process user can read on the host filesystem.
RemediationAI
No vendor-released patch version is identified at time of analysis, and Winstone is a legacy project, so the most reliable remediation is to migrate off Winstone to a maintained servlet container (e.g., Jetty or Tomcat) that properly canonicalizes paths. As compensating controls where migration is not immediate: place Winstone behind a reverse proxy (nginx/Apache) configured to normalize and reject URIs containing '../' or encoded traversal sequences before they reach Winstone (trade-off: requires careful encoding-aware rules to avoid bypass); disable or remove Winstone's static-file serving so application content is served only through servlets that do not map user input to filesystem paths (trade-off: breaks legitimate static asset delivery); and run the engine under a dedicated low-privilege account chrooted/jailed to the webroot so traversal cannot reach sensitive system files (trade-off: limits but does not eliminate disclosure within the jail). Review the VulnCheck advisory (https://www.vulncheck.com/advisories/winstone-servlet-engine-path-traversal-via-http-request-paths) for detection guidance.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today