CVE-2026-13503
antlr ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal
A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
antlr ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal
A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
CVE-2026-13503- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R - CVSS 2.0
- 5.0
AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2026-40001
A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
EUVD-2026-40001- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w346-wxvq-p3xr
A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function...
A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
GHSA-w346-wxvq-p3xr- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
CVE-2026-13503- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-13503
A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
DEBIAN-CVE-2026-13503- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-13503
A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Record
UBUNTU-CVE-2026-13503- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVCLSA-2026-1791457538 No score
TuxCare security update for org.antlr (3 CVEs)
TuxCare rebuilt 6 org.antlr packages to address 3 CVEs. Fixed in 4.13.0-tuxcare.1.
- Record
CLSA-2026-1791457538- Updated
- 2026-11-02
OSVCLSA-2026-1791472866 No score
TuxCare security update for org.antlr (1 CVE)
TuxCare rebuilt 6 org.antlr packages to address 1 CVE. Fixed in 4.11.1-tuxcare.1.
- Record
CLSA-2026-1791472866- Updated
- 2026-11-02
OSVCLSA-2026-1791480304 No score
TuxCare security update for org.antlr (1 CVE)
TuxCare rebuilt 8 org.antlr packages to address 1 CVE. Fixed in 4.7.2-tuxcare.1.
- Record
CLSA-2026-1791480304- Updated
- 2026-11-02
OSVCLSA-2026-1793128354 No score
TuxCare security update for org.antlr (1 CVE)
TuxCare rebuilt 6 org.antlr packages to address 1 CVE. Fixed in 4.10.1-tuxcare.1.
- Record
CLSA-2026-1793128354- Updated
- 2026-11-02
OSVCLSA-2026-1793128545 No score
TuxCare security update for org.antlr (1 CVE)
TuxCare rebuilt 6 org.antlr packages to address 1 CVE. Fixed in 4.13.2-tuxcare.1.
- Record
CLSA-2026-1793128545- Updated
- 2026-11-02
OSVMGASA-2026-0488 No score
Updated antlr4-project package fixes a security vulnerability
ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal. (CVE-2026-13503)
- Record
MGASA-2026-0488- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.antlr:antlr4TuxCare:Maven From an advisory covering 3 CVEs |
4.13.0 up to 4.13.0-tuxcare.1 | 4.13.0-tuxcare.1 |
org.antlr:antlr4-masterTuxCare:Maven From an advisory covering 3 CVEs |
4.13.0 up to 4.13.0-tuxcare.1 | 4.13.0-tuxcare.1 |
org.antlr:antlr4-maven-pluginTuxCare:Maven From an advisory covering 3 CVEs |
4.13.0 up to 4.13.0-tuxcare.1 | 4.13.0-tuxcare.1 |
org.antlr:antlr4-runtimeTuxCare:Maven From an advisory covering 3 CVEs |
4.13.0 up to 4.13.0-tuxcare.1 | 4.13.0-tuxcare.1 |
org.antlr:antlr4-runtime-testsuiteTuxCare:Maven From an advisory covering 3 CVEs |
4.13.0 up to 4.13.0-tuxcare.1 | 4.13.0-tuxcare.1 |
org.antlr:antlr4-tool-testsuiteTuxCare:Maven From an advisory covering 3 CVEs |
4.13.0 up to 4.13.0-tuxcare.1 | 4.13.0-tuxcare.1 |
org.antlr:antlr4TuxCare:Maven |
4.11.1 up to 4.11.1-tuxcare.1 | 4.11.1-tuxcare.1 |
org.antlr:antlr4-masterTuxCare:Maven |
4.11.1 up to 4.11.1-tuxcare.1 | 4.11.1-tuxcare.1 |
org.antlr:antlr4-maven-pluginTuxCare:Maven |
4.11.1 up to 4.11.1-tuxcare.1 | 4.11.1-tuxcare.1 |
org.antlr:antlr4-runtimeTuxCare:Maven |
4.11.1 up to 4.11.1-tuxcare.1 | 4.11.1-tuxcare.1 |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.antlr:antlr4-runtime-testsuiteTuxCare:Maven |
4.11.1 up to 4.11.1-tuxcare.1 | 4.11.1-tuxcare.1 |
org.antlr:antlr4-tool-testsuiteTuxCare:Maven |
4.11.1 up to 4.11.1-tuxcare.1 | 4.11.1-tuxcare.1 |
org.antlr:antlr4TuxCare:Maven |
4.7.2 up to 4.7.2-tuxcare.1 | 4.7.2-tuxcare.1 |
org.antlr:antlr4-masterTuxCare:Maven |
4.7.2 up to 4.7.2-tuxcare.1 | 4.7.2-tuxcare.1 |
org.antlr:antlr4-maven-pluginTuxCare:Maven |
4.7.2 up to 4.7.2-tuxcare.1 | 4.7.2-tuxcare.1 |
org.antlr:antlr4-runtimeTuxCare:Maven |
4.7.2 up to 4.7.2-tuxcare.1 | 4.7.2-tuxcare.1 |
org.antlr:antlr4-runtime-test-annotation-processorsTuxCare:Maven |
4.7.2 up to 4.7.2-tuxcare.1 | 4.7.2-tuxcare.1 |
org.antlr:antlr4-runtime-test-annotationsTuxCare:Maven |
4.7.2 up to 4.7.2-tuxcare.1 | 4.7.2-tuxcare.1 |
org.antlr:antlr4-runtime-testsuiteTuxCare:Maven |
4.7.2 up to 4.7.2-tuxcare.1 | 4.7.2-tuxcare.1 |
org.antlr:antlr4-tool-testsuiteTuxCare:Maven |
4.7.2 up to 4.7.2-tuxcare.1 | 4.7.2-tuxcare.1 |
org.antlr:antlr4TuxCare:Maven |
4.10.1 up to 4.10.1-tuxcare.1 | 4.10.1-tuxcare.1 |
org.antlr:antlr4-masterTuxCare:Maven |
4.10.1 up to 4.10.1-tuxcare.1 | 4.10.1-tuxcare.1 |
org.antlr:antlr4-maven-pluginTuxCare:Maven |
4.10.1 up to 4.10.1-tuxcare.1 | 4.10.1-tuxcare.1 |
org.antlr:antlr4-runtimeTuxCare:Maven |
4.10.1 up to 4.10.1-tuxcare.1 | 4.10.1-tuxcare.1 |
org.antlr:antlr4-runtime-testsuiteTuxCare:Maven |
4.10.1 up to 4.10.1-tuxcare.1 | 4.10.1-tuxcare.1 |
org.antlr:antlr4-tool-testsuiteTuxCare:Maven |
4.10.1 up to 4.10.1-tuxcare.1 | 4.10.1-tuxcare.1 |
org.antlr:antlr4TuxCare:Maven |
4.13.2 up to 4.13.2-tuxcare.1 | 4.13.2-tuxcare.1 |
org.antlr:antlr4-masterTuxCare:Maven |
4.13.2 up to 4.13.2-tuxcare.1 | 4.13.2-tuxcare.1 |
org.antlr:antlr4-maven-pluginTuxCare:Maven |
4.13.2 up to 4.13.2-tuxcare.1 | 4.13.2-tuxcare.1 |
org.antlr:antlr4-runtimeTuxCare:Maven |
4.13.2 up to 4.13.2-tuxcare.1 | 4.13.2-tuxcare.1 |
org.antlr:antlr4-runtime-testsuiteTuxCare:Maven |
4.13.2 up to 4.13.2-tuxcare.1 | 4.13.2-tuxcare.1 |
org.antlr:antlr4-tool-testsuiteTuxCare:Maven |
4.13.2 up to 4.13.2-tuxcare.1 | 4.13.2-tuxcare.1 |
antlr4Debian:12 |
All versions, plus listed versions 4.7.2-54.9.2-14.9.2-24.9.2-3 |
None known |
antlr4Debian:13 |
All versions, plus listed versions 4.9.2-3 |
None known |
antlr4Debian:14 |
All versions, plus listed versions 4.9.2-3 |
None known |
antlr4-projectMageia:10 |
before 4.13.2-3.1.mga10 | 4.13.2-3.1.mga10 |
antlr4Ubuntu:16.04:LTS |
All versions, plus listed versions 4.5.1-14.5.1-2 |
None known |
antlr4Ubuntu:18.04:LTS |
All versions, plus listed versions 4.5.3-24.7.2-1~18.04 |
None known |
antlr4Ubuntu:20.04:LTS |
All versions, plus listed versions 4.7.2-14.7.2-2 |
None known |
antlr4Ubuntu:22.04:LTS |
All versions, plus listed versions 4.7.2-5 |
None known |
antlr4Ubuntu:24.04:LTS |
All versions, plus listed versions 4.7.2-54.9.2-2 |
None known |
antlr4Ubuntu:25.10 |
All versions, plus listed versions 4.9.2-3 |
None known |
antlr4Ubuntu:26.10 |
All versions, plus listed versions 4.9.2-3build1 |
None known |
antlr4Ubuntu:26.04:LTS |
All versions, plus listed versions 4.9.2-34.9.2-3build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-13503 is a medium vulnerability (CVSS 6.9) in Antlr Antlr4, published June 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in org.antlr:antlr4 4.11.1-tuxcare.1.
References
vuldb.com/vuln/374497
github.com/wooyun123/wooyun/issues/8
nvd.nist.gov/vuln/detail/CVE-2026-13503
Show 7 moreShow less
security-tracker.debian.org/tracker/CVE-2026-13503
advisories.mageia.org/MGASA-2026-0488.html
bugs.mageia.org/show_bug.cgi?id=35969
lists.fedoraproject.org/archives/list/[email protected]/message/AQBYU5CQQO6MHRX47JUHB4YRMYUNG45D
ubuntu.com/security/CVE-2026-13503
cve.org/CVERecord?id=CVE-2026-13503