{"id":"CVE-2019-17640","details":"In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.","aliases":["GHSA-vjw7-6gfq-6wf5"],"modified":"2026-07-08T20:15:51.770425Z","published":"2020-10-15T21:15:11.427Z","references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/r591f6932560c8c46cee87415afed92924a982189fea7f7c9096f8e33%40%3Ccommits.pulsar.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r8383b5e7344a8b872e430ad72241b84b83e9701d275c602cfe34a941%40%3Ccommits.servicecomb.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/r8d863b148efe778ce5f8f961d0cafeda399e681d3f0656233b4c5511%40%3Ccommits.pulsar.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rfd0ebf8387cfd0b959d1e218797e709793cce51a5ea2f84d0976f47d%40%3Ccommits.pulsar.apache.org%3E"},{"type":"ADVISORY","url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=567416"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/eclipse-vertx/vert.x","events":[{"introduced":"05683b353b8ad53d28e9a70f0f0bfc2ce36c083c"},{"last_affected":"d4490fed7871b55c3cefa459f622fb22cfead951"},{"introduced":"3daea80a20324bb19e97c8455c648efa62fba104"},{"last_affected":"95372a1f8a7ea235415ce746eda91e0243a59307"}],"database_specific":{"cpe":["cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:milestone1:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:milestone2:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:milestone3:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:milestone4:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:milestone5:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.4.0"},{"last_affected":"3.9.4"},{"introduced":"4.0.0-beta1"},{"last_affected":"4.0.0-beta1"},{"introduced":"4.0.0-beta2"},{"last_affected":"4.0.0-beta2"},{"introduced":"4.0.0-beta3"},{"last_affected":"4.0.0-beta3"},{"introduced":"4.0.0-milestone1"},{"last_affected":"4.0.0-milestone1"},{"introduced":"4.0.0-milestone2"},{"last_affected":"4.0.0-milestone2"},{"introduced":"4.0.0-milestone3"},{"last_affected":"4.0.0-milestone3"},{"introduced":"4.0.0-milestone4"},{"last_affected":"4.0.0-milestone4"},{"introduced":"4.0.0-milestone5"},{"last_affected":"4.0.0-milestone5"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["4.0.0-beta1","4.0.0-beta2","4.0.0-beta3","4.0.0-milestone1","4.0.0-milestone2","4.0.0-milestone3","4.0.0-milestone4","4.0.0-milestone5","3.9.4","3.9.3","3.9.2","3.9.1","3.9.0","3.8.5","3.8.4","3.8.3","3.8.2","3.8.1","3.8.0","3.7.1","3.7.0","3.6.3","3.6.2","3.6.1","3.6.0","3.6.0.CR2","3.6.0.CR1","3.5.1","3.5.0","3.5.0.Beta1","3.4.2","3.4.1","3.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17640.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/vert-x3/vertx-web","events":[{"introduced":"8a11acc912accf4c0661f5c56f1cd387f5200718"},{"last_affected":"1258a682e0ec6a695da8b05063afb0ee57a503c9"},{"introduced":"4b8bd2f1053800a3e79152f2f10026942554a44f"},{"last_affected":"2e72faef41bec6162023aca898678929064870cd"}],"database_specific":{"cpe":["cpe:2.3:a:eclipse:vert.x:*:*:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:beta1:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:beta2:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:beta3:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:milestone1:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:milestone2:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:milestone3:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:milestone4:*:*:*:*:*:*","cpe:2.3:a:eclipse:vert.x:4.0.0:milestone5:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.4.0"},{"last_affected":"3.9.4"},{"introduced":"4.0.0-beta1"},{"last_affected":"4.0.0-beta1"},{"introduced":"4.0.0-beta2"},{"last_affected":"4.0.0-beta2"},{"introduced":"4.0.0-beta3"},{"last_affected":"4.0.0-beta3"},{"introduced":"4.0.0-milestone1"},{"last_affected":"4.0.0-milestone1"},{"introduced":"4.0.0-milestone2"},{"last_affected":"4.0.0-milestone2"},{"introduced":"4.0.0-milestone3"},{"last_affected":"4.0.0-milestone3"},{"introduced":"4.0.0-milestone4"},{"last_affected":"4.0.0-milestone4"},{"introduced":"4.0.0-milestone5"},{"last_affected":"4.0.0-milestone5"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["4.0.0-beta1","4.0.0-beta2","4.0.0-beta3","4.0.0-milestone1","4.0.0-milestone2","4.0.0-milestone3","4.0.0-milestone4","4.0.0-milestone5","3.9.4","3.9.3","3.9.2","3.9.1","3.9.0","3.8.5","3.8.4","3.8.3-01","3.8.3","3.8.2","3.8.1","3.8.0","3.7.1","3.7.0","3.6.3","3.6.2","3.6.1","3.6.0","3.6.0.CR2","3.6.0.CR1","3.5.1","3.5.0","3.4.2","3.4.1","3.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17640.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}