PT-2026-141791
CVE-2026-97881
·
Published
2026-11-10
·
Updated
2026-11-10
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Apache TomEE (affected versions not specified)
Description
The embedded OpenEJB HTTP server fails to restrict static resource paths to the configured resource directories. This allows a remote unauthenticated attacker to perform path traversal to read arbitrary files accessible to the server process.
Recommendations
Block network access to the embedded HTTP server from untrusted clients.
Migrate to the Tomcat based TomEE distributions.
Found an issue in the description? Have something to add? Feel free to write us 👾