CVE-2026-97881
Apache TomEE: Path traversal in embedded HTTP server static resource handling
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
What each source reports
CVE List No score
Apache TomEE: Path traversal in embedded HTTP server static resource handling
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
- Record
CVE-2026-97881- Weakness
- CWE-22
- Updated
- 2026-11-10
EUVDEUVD-2026-121260 No score
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
- Record
EUVD-2026-121260- Updated
- 2026-11-10
GitHub AdvisoriesGHSA-m35h-wjfh-3pj5 No score
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured...
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
- Record
GHSA-m35h-wjfh-3pj5- Weakness
- CWE-22
- Updated
- 2026-11-10
NVD No score
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
- Record
CVE-2026-97881- Weakness
- CWE-22
- Updated
- 2026-11-10
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories, NVD | |
| cwes, references, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97881 is a vulnerability with no CVSS score yet in Apache Software Foundation Tomee, published November 10, 2026. No source lists public exploit code. No source names a fixed version.