{"id":"CVE-2026-97881","aliases":[],"cve":{"records":[{"id":"CVE-2026-97881","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T09:05:14.206Z","published":"2026-11-10T15:32:37.309Z","modified":"2026-11-10T15:32:37.309Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T15:32:37.309Z"}],"references":[{"url":"https://lists.apache.org/thread/pptsyzp963c01nmss9hn7p68pthzdnp9","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: Path traversal in embedded HTTP server static resource handling","titleSource":"apache","descriptionSource":"apache","description":"The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","score":null,"severity":"unknown","published":"2026-11-10T15:32:37.309Z","modified":"2026-11-10T15:32:37.309Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"7.0.0-M1","status":"affected","lessThan":"10.0.0-M1","versionType":"semver"},{"version":"10.0.0-M1","status":"affected","lessThanOrEqual":"10.2.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/openejb-http","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:openejb-http"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-97881"}],"remediation":[],"references":["https://lists.apache.org/thread/pptsyzp963c01nmss9hn7p68pthzdnp9"],"sources":[{"name":"CVE","id":"CVE-2026-97881","modified":"2026-11-10T15:32:37.309Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-97881"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:46:22.506Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:20:35.853Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T16:15:38.050Z","attemptedAt":"2026-11-10T16:15:38.050Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T16:15:38.046Z","attemptedAt":"2026-11-10T16:15:38.046Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-10T16:15:38.229Z","attemptedAt":"2026-11-10T16:15:38.229Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T16:15:37.888Z","attemptedAt":"2026-11-10T16:15:37.888Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-121260","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-121260","modified":"Nov 10, 2026, 3:32:37 PM","checkedAt":"2026-11-10T16:15:38.229Z"}],"aiSummary":{"text":"Apache TomEE versions 7.0.0-M1 to 10.2.0 and 11.0.0-M1 have a path traversal weakness in the embedded HTTP server, allowing a remote unauthenticated attacker to read arbitrary files. The server process must have access to the files. The impact is file disclosure.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:51:32.708Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-97881"}]}}