PT-2025-43147 · Eclipse · Eclipse Vert.X

Sho Odagiri · Published 2025-10-22 · Updated 2026-01-20 · CVE-2025-11966

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions 4.0.0 through 4.5.21 Eclipse Vert.x versions 5.0.0 through 5.0.4

Description When directory listing is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.

Recommendations Update Eclipse Vert.x to a version later than 4.5.21. Update Eclipse Vert.x to a version later than 5.0.4.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2025-11966

ECHO-4377-3F2B-771F

GHSA-45P5-V273-3QQR

Affected Products

Eclipse Vert.X

References · 8

• 🔥 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/303 · Exploit
• https://osv.dev/vulnerability/GHSA-45p5-v273-3qqr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11966 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11966 · Vendor Advisory
• https://github.com/vert-x3/vertx-web/security/advisories/GHSA-45p5-v273-3qqr · Note
• https://github.com/vert-x3/vertx-web · Note
• https://twitter.com/CVEnew/status/1981046815249354906 · Twitter Post
• https://t.me/cveNotify/149324 · Telegram Post