Medium severity6.4NVD Advisory· Published Oct 22, 2025· Updated Jun 17, 2026

CVE-2025-11966

Description

In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
io.vertx:vertx-webMaven	< 4.5.22	4.5.22
io.vertx:vertx-webMaven	>= 5.0.0, < 5.0.5	5.0.5

Affected products

osv-coords41 versions
pkg:apk/chainguard/kafka_exporter-strimzi-compat pkg:apk/chainguard/keycloak-fips-26.4-iamguarded-fips pkg:apk/chainguard/strimzi-kafka-operator-kafka-base pkg:apk/wolfi/apache-pulsar pkg:apk/wolfi/kafka_exporter-strimzi-compat pkg:apk/wolfi/strimzi-kafka-operator pkg:apk/wolfi/strimzi-kafka-operator-kafka-agent-3 pkg:apk/wolfi/strimzi-kafka-operator-tracing-agent pkg:maven/io.vertx/vertx-web pkg:apk/chainguard/apache-pulsar pkg:apk/chainguard/strimzi-kafka-operator-kafka-agent-3 pkg:apk/wolfi/kafka-strimzi-compat pkg:apk/wolfi/keycloak-26.4-iamguarded-compat pkg:apk/wolfi/prometheus-jmx-exporter-strimzi-compat pkg:apk/wolfi/strimzi-kafka-operator-kafka-base pkg:apk/chainguard/strimzi-kafka-operator-topic-operator pkg:apk/chainguard/kafka-strimzi-compat pkg:apk/chainguard/prometheus-jmx-exporter-strimzi-compat pkg:apk/chainguard/strimzi-kafka-operator-cluster-operator pkg:apk/chainguard/strimzi-kafka-operator-kafka-init pkg:apk/chainguard/strimzi-kafka-operator-kafka-thirdparty-libs-cc pkg:apk/chainguard/strimzi-kafka-operator-tracing-agent pkg:apk/wolfi/keycloak-26.4 pkg:apk/wolfi/strimzi-kafka-operator-kafka-agent pkg:apk/wolfi/strimzi-kafka-operator-kafka-init pkg:apk/chainguard/apache-pulsar-compat pkg:apk/chainguard/keycloak-26.4 pkg:apk/chainguard/keycloak-26.4-iamguarded-compat pkg:apk/chainguard/keycloak-fips-26.4 pkg:apk/chainguard/strimzi-kafka-operator pkg:apk/chainguard/strimzi-kafka-operator-kafka-thirdparty-libs pkg:apk/chainguard/strimzi-kafka-operator-mirror-maker-agent pkg:apk/wolfi/apache-pulsar-compat pkg:apk/wolfi/strimzi-kafka-operator-cluster-operator pkg:apk/wolfi/strimzi-kafka-operator-kafka-thirdparty-libs-cc pkg:apk/wolfi/strimzi-kafka-operator-user-operator pkg:apk/chainguard/strimzi-kafka-operator-kafka-agent pkg:apk/chainguard/strimzi-kafka-operator-user-operator pkg:apk/wolfi/strimzi-kafka-operator-kafka-thirdparty-libs pkg:apk/wolfi/strimzi-kafka-operator-mirror-maker-agent pkg:apk/wolfi/strimzi-kafka-operator-topic-operator
< 0.48.0-r1+ 40 more
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 26.4.7-r0
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 4.1.1-r2
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 4.5.22
- (no CPE)range: < 4.1.1-r2
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 26.4.7-r0
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 26.4.7-r0
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 4.1.1-r2
- (no CPE)range: < 26.4.7-r0
- (no CPE)range: < 26.4.7-r0
- (no CPE)range: < 26.4.7-r12
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 4.1.1-r2
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
- (no CPE)range: < 0.48.0-r1
Eclipse Foundation/Vert.xv5
Range: 4.0.0
Eclipse/Vert.x
cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*
Range: >=4.0.0,<4.5.22

Patches

Vulnerability mechanics

References

gitlab.eclipse.org/security/vulnerability-reports/-/issues/303nvdExploitIssue TrackingVendor AdvisoryWEB
github.com/advisories/GHSA-45p5-v273-3qqrghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-11966ghsaADVISORY
github.com/vert-x3/vertx-web/security/advisories/GHSA-45p5-v273-3qqrghsaWEB

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

6.4/ 10

CVSS v42.3

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Affected

Source repo: github.com/vert-x3/vertx-web

EPSS

Probability of exploitation in the next 30 days.

0.27%

VYPR risk score

Composite of severity, exploitation, and reach.

0.42medium

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVE ID

CVE-2025-11966

Credits

SO
Sho Odagiri
finder