Stored Cross-Site Scripting in Eclipse Vert.x Due to Improper Escaping

CVE-2025-11966

What is CVE-2025-11966?

A stored cross-site scripting vulnerability exists in Eclipse Vert.x versions 4.0.0 to 4.5.21 and 5.0.0 to 5.0.4, triggered when directory listing is enabled. The vulnerability arises from improper escaping of file and directory names inserted into generated HTML, allowing an attacker who can manipulate files within the served path to inject malicious scripts. These scripts execute in the context of users accessing the directory, potentially compromising sensitive information and user sessions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References