{"id":"CVE-2019-17640","aliases":["EUVD-2022-1208","GHSA-vjw7-6gfq-6wf5"],"status":"published","title":"Path Traversal in Eclipse Vert","description":"In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02002,"percentile":0.8091,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22","CWE-23"],"published":"2020-10-15T20:30:15Z","modified":"2026-10-24T10:50:35Z","exploits":[{"source":"pocgithub","id":"shoucheng3/vert-x3__vertx-web_CVE-2019-17640_3-9-3","title":"shoucheng3/vert-x3__vertx-web_CVE-2019-17640_3-9-3","date":"2025-08-20","url":"https://github.com/shoucheng3/vert-x3__vertx-web_CVE-2019-17640_3-9-3"}],"fixes":[{"ecosystem":"Maven","package":"io.vertx:vertx-web","fixed_in":["3.9.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.vertx:vertx-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.9.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.vertx:vertx-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.9.4"}]}],"versions":["3.0.0","3.1.0","3.2.0","3.2.1","3.3.0","3.3.0.CR1","3.3.0.CR2","3.3.1","3.3.2","3.3.3","3.4.0","3.4.0.Beta1","3.4.1","3.4.2","3.5.0","3.5.0.Beta1","3.5.1","3.5.2","3.5.2.CR1","3.5.2.CR2","3.5.2.CR3","3.5.3","3.5.3.CR1","3.5.4","3.6.0","3.6.0.CR1","3.6.0.CR2","3.6.1","3.6.2","3.6.3","3.7.0","3.7.1","3.8.0","3.8.1","3.8.2","3.8.3","3.8.3-01","3.8.4","3.8.5","3.9.0","3.9.1","3.9.2","3.9.3"]}],"products":[{"vendor":"eclipse","product":"vert.x"},{"vendor":"eclipse foundation","product":"eclipse vert.x"},{"vendor":"the eclipse foundation","product":"eclipse vert.x"}],"references":[{"url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=567416","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r8383b5e7344a8b872e430ad72241b84b83e9701d275c602cfe34a941%40%3Ccommits.servicecomb.apache.org%3E","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rfd0ebf8387cfd0b959d1e218797e709793cce51a5ea2f84d0976f47d%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r8d863b148efe778ce5f8f961d0cafeda399e681d3f0656233b4c5511%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r591f6932560c8c46cee87415afed92924a982189fea7f7c9096f8e33%40%3Ccommits.pulsar.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17640","tags":["advisory"]},{"url":"https://github.com/vert-x3/vertx-web/commit/b12f7c4c6576a8adc3f683b2899de4b0e7d099e4","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8383b5e7344a8b872e430ad72241b84b83e9701d275c602cfe34a941@%3Ccommits.servicecomb.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://mvnrepository.com/artifact/io.vertx/vertx-web","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rfd0ebf8387cfd0b959d1e218797e709793cce51a5ea2f84d0976f47d@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r8d863b148efe778ce5f8f961d0cafeda399e681d3f0656233b4c5511@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r591f6932560c8c46cee87415afed92924a982189fea7f7c9096f8e33@%3Ccommits.pulsar.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vjw7-6gfq-6wf5"}],"sources":{"cve":[{"id":"CVE-2019-17640","description":"In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.","status":"published","published":"2020-10-15T20:30:15Z","modified":"2024-08-05T01:47:13.749Z","cwes":["CWE-23"],"updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2022-1208","description":"In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.","status":"published","published":"2020-10-15T20:30:15Z","modified":"2024-08-05T01:47:13Z","updated_at":"2026-11-03T02:40:28.860423Z"}],"ghsa":[{"id":"GHSA-vjw7-6gfq-6wf5","title":"Path Traversal in Eclipse Vert","description":"In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0-milestone1, 4.0.0-milestone2, 4.0.0-milestone3, 4.0.0-milestone4, 4.0.0-milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.","status":"published","published":"2022-02-10T20:28:57Z","modified":"2023-02-01T05:05:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22","CWE-23"],"updated_at":"2026-11-02T14:36:34.260786Z"}],"nvd":[{"id":"CVE-2019-17640","description":"In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.","status":"published","published":"2020-10-15T21:15:11.427Z","modified":"2026-06-17T02:24:19.793Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-23","CWE-22"],"updated_at":"2026-11-02T14:05:47.558959Z"}],"osv":[{"id":"CVE-2019-17640","description":"In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.","status":"published","published":"2020-10-15T21:15:11.427Z","modified":"2026-10-24T10:50:35.684146681Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"GHSA-vjw7-6gfq-6wf5","title":"Path Traversal in Eclipse Vert","description":"In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0-milestone1, 4.0.0-milestone2, 4.0.0-milestone3, 4.0.0-milestone4, 4.0.0-milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.","status":"published","published":"2022-02-10T20:28:57Z","modified":"2023-11-08T04:01:25.474533Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22","CWE-23"],"updated_at":"2026-11-02T15:46:57.348035Z"}]}}