CVE-2021-28169: Eclipse Jetty ConcatServlet path traversal exposes WEB-INF files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is remotely reachable without authentication and has very high EPSS, though it only discloses information and no in-the-wild exploitation is confirmed.

What it is

Eclipse Jetty versions up to 9.4.40, 10.0.2 and 11.0.2 allow requests to the ConcatServlet with a doubly encoded path to reach protected resources under WEB-INF. A request such as /concat?/%2557EB-INF/web.xml returns web.xml, leaking implementation details of the web application.

Impact

An unauthenticated remote attacker can read files inside WEB-INF, including web.xml and other configuration or class resources, exposing internal application structure and sensitive implementation details. The flaw is read-only information disclosure; there is no evidence of code execution or data modification.

Attack surface

Reachable over the network via HTTP against a Jetty instance that has the ConcatServlet mapped and serving content. The CVSS vector shows no privileges and no user interaction required, so any client able to send a crafted request can attempt it.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.7848 (99.56th percentile), indicating elevated likelihood of attempted exploitation. References are advisories and vendor patch notices, with no public exploit tag in the record.

What to do

• Upgrade Eclipse Jetty to a fixed release above 9.4.40, 10.0.2 and 11.0.2, or apply the vendor patch referenced in the Jetty security advisory GHSA-gwcr-j4wh-j3cq.
• Apply the Oracle, Debian and NetApp vendor updates for bundled Jetty components listed in the affected products.
• If ConcatServlet is not required, remove or disable its servlet mapping to eliminate the attack path.
• Restrict network access to Jetty HTTP endpoints and place them behind a reverse proxy that normalizes and rejects doubly encoded paths.
• Verify that WEB-INF content contains no secrets, since exposure of configuration files is the core risk.

Detection

• Search HTTP access logs for requests to /concat with percent-encoded sequences such as %2557EB-INF or double-encoded path segments.
• Alert on any request whose decoded path resolves into WEB-INF, especially web.xml, from external clients.
• Monitor for repeated 200 responses to ConcatServlet URLs from single source IPs, which may indicate scanning or exploitation attempts.
• Review proxy and WAF logs for encoded traversal patterns targeting Jetty servlet endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.