Path traversal in Apache JSPWiki
Priority MEDIUM 45CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.
Why it matters now
EPSS 0.09992 95th percentileScored 2026-11-07
Fix Fixed org.apache.jspwiki:jspwiki-war (Maven): 2.11.0.M3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache JSPWiki | Apache JSPWiki 2.9.0 to 2.11.0.M2 | — | No fix listed | CNA |
| — | org.apache.jspwiki:jspwiki-war (Maven) | 2.9.0 to before 2.11.0.M3 | 2.11.0.M3 | Patch available | GHSA-pffw-p2q5-w6vh |
- Apache JSPWiki VendorApache Affected Apache JSPWiki 2.9.0 to 2.11.0.M2 Fixed in — No fix listed CNA
- org.apache.jspwiki:jspwiki-war (Maven) Vendor— Affected 2.9.0 to before 2.11.0.M3 Fixed in 2.11.0.M3 Patch available GHSA-pffw-p2q5-w6vh
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:* | 2.9.0 to before 2.11.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:-:*:*:*:*:*:* | 2.11.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:milestone1-rc1:*:*:*:*:*:* | 2.11.0 milestone1-rc1 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:milestone1-rc2:*:*:*:*:*:* | 2.11.0 milestone1-rc2 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:milestone1-rc3:*:*:*:*:*:* | 2.11.0 milestone1-rc3 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:milestone2:*:*:*:*:*:* | 2.11.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:jspwiki:2.11.0:milestone2-rc1:*:*:*:*:*:* | 2.11.0 milestone2-rc1 | Vulnerable | Apache |
- cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:* Versions 2.9.0 to before 2.11.0 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:-:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:milestone1-rc1:*:*:*:*:*:* Versions 2.11.0 milestone1-rc1 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:milestone1-rc2:*:*:*:*:*:* Versions 2.11.0 milestone1-rc2 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:milestone1-rc3:*:*:*:*:*:* Versions 2.11.0 milestone1-rc3 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:milestone2:*:*:*:*:*:* Versions 2.11.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:jspwiki:2.11.0:milestone2-rc1:*:*:*:*:*:* Versions 2.11.0 milestone2-rc1 Vulnerable ·Apache
Remediation
- Fix · GHSA-pffw-p2q5-w6vh org.apache.jspwiki:jspwiki-war (Maven) Fixed in 2.11.0.M3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0225
- 2026-10-03 Alias added: GHSA-pffw-p2q5-w6vh
References
Advisory 4
- [oss-security] 20190326 [CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure
- https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-0225
- https://nvd.nist.gov/vuln/detail/CVE-2019-0225
- https://github.com/advisories/GHSA-pffw-p2q5-w6vh
Other 10
- [jspwiki-user] 20190326 [CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure
- [jspwiki-dev] 20190326 [CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure
- [announce] 20190326 [CVE-2019-0225] Apache JSPWiki Local File Inclusion (limited ROOT folder) vulnerability leads to user information disclosure
- [jspwiki-commits] 20190329 [jspwiki-site] branch jbake updated: add CVE-2019-0224 and CVE-2019-0225 vulnerability disclosures
- [jspwiki-commits] 20190519 [jspwiki-site] branch jbake updated: added CVE-2019-10076, CVE-2019-10077 and CVE-2019-10078 vulnerability disclosures
- https://lists.apache.org/thread.html/03ddbcb1d6322e04734e65805a147a32bcfdb71b8fc5821fb046ba8d@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/4f19fdbd8b9c4caf6137a459d723f4ec60379b033ed69277eb4e0af9@%3Cuser.jspwiki.apache.org%3E
- https://lists.apache.org/thread.html/6251c06cb11e0b495066be73856592dbd7ed712487ef283d10972831@%3Cdev.jspwiki.apache.org%3E
- https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16@%3Ccommits.jspwiki.apache.org%3E
- https://lists.apache.org/thread.html/e42d6e93384d4a33e939989cd00ea2a06ccf1e7bb1e6bdd3bf5187c1@%3Ccommits.jspwiki.apache.org%3E
More Apache Jspwiki vulnerabilities
- TI-2022-11364 Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp CVSS 3.1MEDIUM 6.1
- TI-2022-10292 XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2 CVSS 3.1MEDIUM 6.1
- TI-2022-11366 Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin CVSS 3.1MEDIUM 6.1
- TI-2022-11365 Apache JSPWiki CSRF in UserPreferences.jsp CVSS 3.1MEDIUM 6.5
- TI-2024-17991 Apache JSPWiki: Cross-site scripting vulnerability on upload page CVSS 3.1MEDIUM 6.1
- TI-2026-23006 Apache JSPWiki: UserManager does not sanity-check user database at startup CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-0225 · CVE Program
- CVE-2019-0225 · NVD
- FIRST EPSS
- GHSA-pffw-p2q5-w6vh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences