Eclipse Adoptium CVE-2026-93649

Requires a victim to follow an attacker-crafted adoptium.net /[locale]/download URL whose 'link' query parameter embeds ../ dot-segments that resolve off the trusted-prefix allowlist (e.g. https://github.com/adoptium/temurin/../../attacker-org/malware/releases/download/v1/jdk.exe). No authentication, privileges, or non-default server configuration is needed - every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in cbb53cf (2026-09-24) is affected. Limiting factors: the attack depends on user interaction (the victim must click the crafted link, typically delivered via phishing) and on the victim subsequently executing the downloaded binary to achieve code execution; the website has since been patched, so only the historical window is exposed.

Signals point to a real but moderate, non-urgent issue. The vendor CVSS of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) treats this as network-reachable, low-complexity, unauthenticated with high integrity impact and no confidentiality/availability impact - consistent with CWE-494 (untrusted download). However, the description explicitly requires a victim to follow a crafted adoptium.net link, which is user interaction (UI:R), so the vendor's UI:N appears optimistic and the effective exploitability is lower than 7.5 suggests. Exploitation probability signals are low and mutually consistent: EPSS is 0.11% (1st percentile), the CVE is NOT in CISA KEV, and no public exploit was identified (the referenced GitHub artifact is the fix commit with regression tests demonstrating the bypass, not a weaponized POC). There is no SSVC decision data in the input. The mitigating factor is that exploitation depends on social engineering plus the victim subsequently executing the downloaded binary; the aggravating factor is that the malicious download is served under the genuine adoptium.net 'Thank you for downloading' page, which strongly boosts phishing credibility and lends this a supply-chain/malware-delivery character. Net: a legitimate flaw worth patching, already fixed server-side, but not a high-priority emergency given low EPSS, no KEV, no public exploit, and the required user interaction.

An attacker crafts an adoptium.net/[locale]/download URL whose 'link' parameter is e.g. https://github.com/adoptium/temurin/../../attacker-org/malware/releases/download/v1/jdk.exe; it passes the String.startsWith() allowlist check on the raw string but the browser normalises the ../ segments and resolves to an attacker repository. The victim clicks the link (e.g. via phishing), sees the authentic Temurin thank-you page, and their browser silently downloads the attacker's binary. No public exploit exists, but the fix commit includes test cases that demonstrate the dot-segment traversal bypass.