CVE-2026-8384¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
In Eclipse Jetty, an HTTP URI of the form /public;/../admin/secret.txt results in an unresolved path of /public/../admin/secret.txt instead of the expected /admin/secret.txt. Jetty itself is not affected, as it will not serve the file - only resolved resources pass its alias checker. However, web applications that rely on Jetty providing resolved paths may be confused when handed an unresolved one.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.3.0
WSO2 JUSTIFICATION¶
WSO2 Identity Server bundles Apache Solr for registry content indexing and search, and the Solr orbit bundle carries the reported jetty-util artifact.
The defect is exploitable only when Jetty's URIUtil.canonicalPath()/decodePath() resolves inbound request paths - that is, when Jetty runs as an HTTP server and a downstream filter makes path-based authorization decisions on the path Jetty hands it.12
That configuration does not exist in the product. The JettySolrRunner class that starts Jetty as a standalone HTTP server is not present, and only Jetty's client-side modules are shipped: the Solr orbit bundle embeds jetty-client, jetty-io, jetty-http, jetty-util and the HTTP/2 client transports, while jetty-server, jetty-servlet, jetty-security and the jetty-ee* modules are absent from the distribution.4 Solr itself runs embedded, driven through the EmbeddedSolrServer API by direct in-process Java method calls, so the shipped Solr path constructs no Jetty server or connector and never presents a request path to URIUtil for resolution. Separately, WSO2 Identity Server serves all inbound HTTP through embedded Apache Tomcat.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above. Since the vulnerable artifact is physically shipped rather than being a declaration-only transitive edge, the bundled Jetty distribution will be upgraded to a fixed version in a future release.3