Apache Juneau: Path traversal vulnerability (CVE-2026-121489)

Apache Juneau versions 9.2.0 and earlier are vulnerable to a path traversal vulnerability (CVE-2026-121489) in the DirectoryResource component. The vulnerability arises because the resource does not correctly validate request paths against the configured root directory. When the view, upload, or delete settings are enabled, an attacker can access, modify, or remove files anywhere the server process has permissions. The fix is available in Apache Juneau version 9.2.1.

Impact

Successful exploitation allows for unauthorized arbitrary file read, write, and delete operations on the server hosting the affected service. The vulnerability is rated with a CVSS 4.0 score of 10.0 (Critical).

Recommendation

• Upgrade Apache Juneau to version 9.2.1 or later immediately.
• Audit all DirectoryResource configurations in Juneau deployments; if the feature is not strictly required, disable the view, upload, and delete functionality.
• Review web server access logs for requests containing directory traversal sequences (e.g., '../') directed at the Juneau microservice endpoint.