{
  "cveId": "CVE-2026-8384",
  "url": "https://patchblox.com/security/cve/CVE-2026-8384",
  "summary": "CVE-2026-8384 is fixed in jetty12 on 1 platform by DEBIAN-CVE-2026-8384 (version 12.0.39-1), released July 14, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "jetty12: In Eclipse Jetty, an HTTP URI of this form:      /public;/../admin/secret.txt         results in an unresolved path o...",
  "description": "In Eclipse Jetty, an HTTP URI of this form:      /public;/../admin/secret.txt         results in an unresolved path of:      /public/../admin/secret.txt         instead of the expected:      /admin/secret.txt         Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).     However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.",
  "published": "2026-07-14T09:16:42Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "epss": 0.0033,
  "epssPercentile": 0.26335,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "jetty12",
      "release": "Debian 14",
      "fixedVersion": "12.0.39-1",
      "fix": "DEBIAN-CVE-2026-8384",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-8384",
      "released": "2026-07-14T09:16:42Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}