Path traversal in Eclipse GlassFish
Priority LOW 35CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code. This is fixed in GlassFish 7.0.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00961 61st percentileScored 2026-11-07
Fix Fixed Eclipse GlassFish (The Eclipse Foundation): 7.0.0org.glassfish.main.web:web (Maven): 7.0.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse GlassFish | 5.1.0 to before 7.0.0 | 7.0.0 | Patch available | CNA |
| — | org.glassfish.main.web:web (Maven) | 5.1.0 to before 7.0.0 | 7.0.0 | Patch available | GHSA-3g5w-6pw7-6hrp |
- Eclipse GlassFish VendorEclipse Foundation Affected 5.1.0 to before 7.0.0 Fixed in 7.0.0 Patch available CNA
- org.glassfish.main.web:web (Maven) Vendor— Affected 5.1.0 to before 7.0.0 Fixed in 7.0.0 Patch available GHSA-3g5w-6pw7-6hrp
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:glassfish:*:*:*:*:*:*:*:* | 5.1.0 – 6.2.5 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:glassfish:*:*:*:*:*:*:*:* Versions 5.1.0 – 6.2.5 Vulnerable ·Eclipse Foundation
Remediation
- Fix · CNA Eclipse GlassFish (The Eclipse Foundation) Fixed in 7.0.0
- Fix · GHSA-3g5w-6pw7-6hrp org.glassfish.main.web:web (Maven) Fixed in 7.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2712
- 2026-10-03 Alias added: GHSA-3g5w-6pw7-6hrp
References
More Eclipse Foundation Glassfish vulnerabilities
- TI-2026-02210 Expression language injection in Eclipse Glassfish CVSS 3.1CRITICAL 9.6
- TI-2023-05301 Glassfish remote code execution CVSS 3.1CRITICAL 9.8
- TI-2026-10805 Server-side request forgery in Eclipse GlassFish CVSS 3.1CRITICAL 9.6
- TI-2026-02209 Expression language injection in Eclipse Glassfish CVSS 3.1CRITICAL 9.1
- TI-2024-08729 Server-side request forgery in Eclipse Glassfish CVSS 4.0HIGH 8.9
- TI-2024-08661 Glassfish redirect to untrusted site CVSS 4.0MEDIUM 6.9
Sources
- CVE-2022-2712 · CVE Program
- CVE-2022-2712 · NVD
- FIRST EPSS
- GHSA-3g5w-6pw7-6hrp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences