Directory Access Configuration Flaw in Eclipse Vert.x
CVE-2025-11965

6.3MEDIUM

Key Information:

Vendor

Eclipse Foundation

Status
Vert.x
Vendor
CVE Published:
22 October 2025

What is CVE-2025-11965?

A configuration flaw in the StaticHandler of Eclipse Vert.x allows unauthorized users to access hidden directories. Specifically, it fails to prevent access to files stored in these directories, which can include sensitive information such as '.git/config'. This vulnerability highlights the importance of properly configuring access controls to enhance security and prevent unauthorized information disclosure.

Affected Version(s)

Vert.x 4.0.0 < 4.5.22

Vert.x 5.0.0 < 5.0.5

References

https://gitlab.eclipse.org/security/vulnerability-reports...

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sho Odagiri
JSON
.
CVE-2025-11965 : Directory Access Configuration Flaw in Eclipse Vert.x