HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-56122 — Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability t...

·Source: NIST NVD

Updated:

Executive Summary

Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the configured webroot. Attackers can traverse outside the webroot directory using traversal-prefixed paths in a single HTTP request to read any fi

Analysis

Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the configured webroot. Attackers can traverse outside the webroot directory using traversal-prefixed paths in a single HTTP request to read any file accessible to the servlet engine process, including sensitive system files when the service runs with elevated privileges. CVSS Score: 7.5. Published: 2026-06-25T14:16:51.513.

Indicators of Compromise (1)

CVE (1)
CVE-2026-56122
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 25, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

Pico and LDA Technologies partner on high-fidelity data for real-time AI and trading workflows

Pico, a leading global provider of mission-critical technology services, software, data and analytics for the financial markets community, and LDA Technologies, a leader in ultra-low latency networking and FPGA applications, today announced that Pico’s Corvil Analytics platform will support LDA Technologies’ NeoTap X aggregation technology in the upcoming Corvil Analytics 10.2 release.

Finextra
MEDIUMVulnerabilityNEW

DHS confirms hackers breached HSIN info-sharing platform

The Department of Homeland Security is investigating a cyberattack that compromised the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by federal, state, local, and private-sector partners. [...]

BleepingComputer
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-34110 — Guardian language-system passes the id GET parameter directly into a PHP exec() ...

Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (line 14) without sanitization: exec(\"php jobs/complex.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An unauthenticated remote attacker can append shell metacharacters to execute arbitrary OS commands on the server.

CVE-2026-34110
NIST NVD