High severity7.6NVD Advisory· Published Sep 21, 2023· Updated Jun 17, 2026
CVE-2023-4760
CVE-2023-4760
Description
In Eclipse RAP versions from 3.0.0 up to and including 3.25.0, Remote Code Execution is possible on Windows when using the FileUpload component.
The reason for this is a not completely secure extraction of the file name in the FileUploadProcessor.stripFileName(String name) method. As soon as this finds a / in the path, everything before it is removed, but potentially \ (backslashes) coming further back are kept.
For example, a file name such as /..\..\webapps\shell.war can be used to upload a file to a Tomcat server under Windows, which is then saved as ..\..\webapps\shell.war in its webapps directory and can then be executed.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:eclipse:remote_application_platform:*:*:*:*:*:*:*:*Range: >=3.0.0,<=3.25.0
- Eclipse Foundation/Eclipse RAPv5Range: 3.0.0
Patches
Vulnerability mechanics
References
2- github.com/eclipse-rap/org.eclipse.rap/pull/141nvdIssue TrackingPatch
- gitlab.eclipse.org/security/vulnerability-reports/-/issues/160nvdExploitIssue Tracking
News mentions
0No linked articles in our index yet.