{"id":"CVE-2018-12542","aliases":["EUVD-2018-0608","GHSA-h39x-m55c-v55h"],"status":"published","title":"Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location","description":"In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02224,"percentile":0.82832,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2018-10-10T20:00:00Z","modified":"2026-10-24T10:47:39Z","exploits":[{"source":"pocgithub","id":"shoucheng3/vert-x3__vertx-web_CVE-2018-12542_3-5-3-CR1","title":"shoucheng3/vert-x3__vertx-web_CVE-2018-12542_3-5-3-CR1","date":"2025-08-16","url":"https://github.com/shoucheng3/vert-x3__vertx-web_CVE-2018-12542_3-5-3-CR1"}],"fixes":[{"ecosystem":"Maven","package":"io.vertx:vertx-web","fixed_in":["3.5.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.vertx:vertx-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.5.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.vertx:vertx-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.5.4"}]}],"versions":["3.0.0","3.1.0","3.2.0","3.2.1","3.3.0","3.3.0.CR1","3.3.0.CR2","3.3.1","3.3.2","3.3.3","3.4.0","3.4.0.Beta1","3.4.1","3.4.2","3.5.0","3.5.0.Beta1","3.5.1","3.5.2","3.5.2.CR1","3.5.2.CR2","3.5.2.CR3","3.5.3","3.5.3.CR1"]}],"products":[{"vendor":"eclipse","product":"vert.x"},{"vendor":"eclipse foundation","product":"eclipse vert.x"},{"vendor":"the eclipse foundation","product":"eclipse vert.x"}],"references":[{"url":"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://github.com/vert-x3/vertx-web/issues/1025","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","evidence","web"]},{"url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=539171","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12542","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h39x-m55c-v55h","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://github.com/vert-x3/vertx-web/commit/57a65dce6f4c5aa5e3ce7288685e7f3447eb8f3b","tags":["web"]},{"url":"https://github.com/vert-x3/vertx-web","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-12542","description":"In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.","status":"published","published":"2018-10-10T20:00:00Z","modified":"2024-08-05T08:38:06.14Z","updated_at":"2026-11-02T14:35:06.320867Z"}],"euvd":[{"id":"EUVD-2018-0608","description":"In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.","status":"published","published":"2018-10-10T20:00:00Z","modified":"2024-08-05T08:38:06Z","updated_at":"2026-11-03T02:39:52.61924Z"}],"ghsa":[{"id":"GHSA-h39x-m55c-v55h","title":"Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location","description":"In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.","status":"published","published":"2018-10-17T16:20:45Z","modified":"2023-04-05T19:34:14Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:49.768564Z"}],"nvd":[{"id":"CVE-2018-12542","description":"In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.","status":"published","published":"2018-10-10T20:29:00.553Z","modified":"2026-06-17T01:37:56.65Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:04:44.873741Z"}],"osv":[{"id":"CVE-2018-12542","description":"In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.","status":"published","published":"2018-10-10T20:29:00.553Z","modified":"2026-10-24T10:47:39.5447647Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"GHSA-h39x-m55c-v55h","title":"Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location","description":"In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.","status":"published","published":"2018-10-17T16:20:45Z","modified":"2023-11-08T03:59:50.04213Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:48.546324Z"}]}}