CVE-2026-8384

Name of the Vulnerable Software and Affected Versions Eclipse Jetty (affected versions not specified)

Description An issue exists where an HTTP URI containing a semicolon, such as /public;/../admin/secret.txt, results in an unresolved path of /public/../admin/secret.txt instead of the expected /admin/secret.txt. While the server does not serve the file directly because it fails the alias checker, web applications that rely on Jetty to provide resolved paths may be misled by receiving an unresolved path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.