CVE-2025-11966

Vulnerability

Description

In Eclipse Vert.x versions 4.0.0 through 4.5.21 and 5.0.0 through 5.0.4, when directory listing is enabled via StaticHandler, file and directory names are inserted directly into the generated HTML without proper escaping. The StaticHandlerImpl#sendDirectoryListing method constructs ` elements using file names in href, title`, and link text without sanitization, leading to stored cross-site scripting (XSS) [1][2].

Exploitation

An attacker who can create or rename files or directories within a served path can craft filenames containing malicious HTML or JavaScript. For example, a file named .txt will cause the script to execute when any user browses the directory listing page. No authentication is required beyond the ability to control file names, and the attack does not require any user interaction beyond accessing the listing [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, data theft, or defacement. The XSS is stored in the directory listing and affects all users visiting the compromised path.

Mitigation

Patched versions are 4.5.22 and 5.0.5. Users should upgrade immediately. If upgrade is not possible, disable directory listing or restrict file name creation to trusted users [2].