Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') McWebserver Minecraft Mod
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows all files, accessible by the program, to be read by anyone via HTTP request. Version 0.2.0 with patches are released to both platforms (Fabric and Quilt, Forge). As a workaround, the McWebserver mod can be disabled by removing the file from the `mods` directory.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| J-onasJones | McWebserver | before 0.2.0 | 0.2.0 | Patch available | CNA |
- McWebserver VendorJ-onasJones Affected before 0.2.0 Fixed in 0.2.0 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mcwebserver_minecraft_mod_for_fabric_and_quilt_project:mcwebserver_minecraft_mod_for_fabric_and_quilt:*:*:*:*:*:*:*:* | up to 0.1.2.1 | Vulnerable | Mcwebserver Minecraft Mod For Fabric And Quilt Project |
| cpe:2.3:a:mcwebserver_minecraft_mod_for_forge_project:mcwebserver_minecraft_mod_for_forge:*:*:*:*:*:*:*:* | up to 0.1.1 | Vulnerable | Mcwebserver Minecraft Mod For Forge Project |
- cpe:2.3:a:mcwebserver_minecraft_mod_for_fabric_and_quilt_project:mcwebserver_minecraft_mod_for_fabric_and_quilt:*:*:*:*:*:*:*:* Versions up to 0.1.2.1 Vulnerable ·Mcwebserver Minecraft Mod For Fabric And Quilt Project
- cpe:2.3:a:mcwebserver_minecraft_mod_for_forge_project:mcwebserver_minecraft_mod_for_forge:*:*:*:*:*:*:*:* Versions up to 0.1.1 Vulnerable ·Mcwebserver Minecraft Mod For Forge Project
Remediation
- Fix · CNA McWebserver (J-onasJones) Fixed in 0.2.0
Timeline
- 2026-10-02 Threatist record created from CVE-2022-39221
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences