← Vulnerability feed

Vulnerability record · CVE-2025-11966 · published 22 October 2025

CVE-2025-11966: Eclipse vert.x cross-site scripting vulnerability

Eclipse · Vert.X

In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.

2.3 CVSS 4.0 Low EPSS 0.29% · top 80.5% CWE-79 · Cross-site scriptingCWE-80 · CWE-80
2.3CVSS 4.0 base score
0.29%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/303 ExploitIssue TrackingVendor Advisory

Track CVE-2025-11966 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-17640Eclipse vert.x relative path traversal vulnerabilityIn Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Bet…EPSS 2.0%9.8CVE-2018-12542Eclipse vert.x path traversal vulnerabilityIn version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted di…EPSS 2.2%9.8CVE-2018-12544Eclipse vert.x xml external entity (xxe) vulnerabilityIn version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against X…EPSS 2.2%8.8CVE-2018-12540Eclipse vert.x cross-site request forgery vulnerabilityIn version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter.…EPSS 2.0%8.2CVE-2026-15075Eclipse vert.x information exposure vulnerabilityIn Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request…EPSS 0.20%8.2CVE-2026-15076Eclipse vert.x origin validation error vulnerabilityIn versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not vali…EPSS 0.20%6.9CVE-2026-6860Eclipse vert.x allocation without limits vulnerabilityA TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if…EPSS 0.31%6.9CVE-2024-8391Eclipse vert.x allocation without limits vulnerabilityIn Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server does not limit the maximum length of message payload (Maven GAV: io.vertx:vertx-grpc-server…EPSS 0.58%

Source: NIST National Vulnerability Database (record CVE-2025-11966), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.