← Vulnerability feed

Vulnerability record · CVE-2018-12542 · published 10 October 2018

CVE-2018-12542: Eclipse vert.x path traversal vulnerability

Eclipse · Vert.X

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.

9.8 CVSS 3.0 Critical EPSS 2.2% · top 18.0% CWE-22 · Path traversal
9.8CVSS 3.0 base score, v2 7.5
2.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugs.eclipse.org/bugs/show_bug.cgi?id=539171 Issue TrackingVendor Advisory
https://github.com/vert-x3/vertx-web/issues/1025 ExploitVendor Advisory
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apach
https://bugs.eclipse.org/bugs/show_bug.cgi?id=539171 Issue TrackingVendor Advisory
https://github.com/vert-x3/vertx-web/issues/1025 ExploitVendor Advisory
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apach

Track CVE-2018-12542 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-17640Eclipse vert.x relative path traversal vulnerabilityIn Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Bet…EPSS 2.0%9.8CVE-2018-12544Eclipse vert.x xml external entity (xxe) vulnerabilityIn version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against X…EPSS 2.2%8.8CVE-2018-12540Eclipse vert.x cross-site request forgery vulnerabilityIn version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter.…EPSS 2.0%8.2CVE-2026-15075Eclipse vert.x information exposure vulnerabilityIn Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request…EPSS 0.20%8.2CVE-2026-15076Eclipse vert.x origin validation error vulnerabilityIn versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not vali…EPSS 0.20%6.9CVE-2026-6860Eclipse vert.x allocation without limits vulnerabilityA TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if…EPSS 0.31%6.9CVE-2024-8391Eclipse vert.x allocation without limits vulnerabilityIn Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server…EPSS 0.58%6.5CVE-2018-12541Eclipse vert.x memory buffer overflow vulnerabilityIn version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake,…EPSS 2.7%

Source: NIST National Vulnerability Database (record CVE-2018-12542), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.