VYPR
← All advisories
Low severityNVD Advisory· Published Oct 22, 2025· Updated Oct 22, 2025

CVE-2025-11966

CVE-2025-11966

Description

In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
io.vertx:vertx-webMaven
< 4.5.224.5.22
io.vertx:vertx-webMaven
>= 5.0.0, < 5.0.55.0.5

Affected products

42

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.