CVE-2025-11965

In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories, allowing unauthorized users to retrieve files within them (e.g. '.git/config').

Score

CVSS 3.1 7.5 High

Status

Analyzed - emo@eclipse.org

Published

2025-10-22

Last modified

2026-10-08

Weaknesses

CWE-552

Affected products

• Vert.x (Eclipse)
• Vert.x (Eclipse Foundation)

References

• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/304