GHSA-px9h-x66r-8mpc is a medium-severity (CVSS 5.3) Path Traversal vulnerability in io.jooby:jooby. 2 public exploit references exist, so weaponization risk is real. O3 Security confirms whether GHSA-px9h-x66r-8mpc is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
path traversal in Jooby
Real-World Exposure
io.jooby:jooby☕org.jooby:joobyReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Impact
Access to sensitive information available from classpath.
Patches
Patched version: 1.6.7 and 2.8.2
Commit 1.x: https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009
Commit 2.x: https://github.com/jooby-project/jooby/commit/c81479de67036993f406ccdec23990b44b0bec32
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
References
Latest 1.x version: 1.6.6
Arbitrary class path resource access 1
When sharing a File System directory as in:
assets("/static/**", Paths.get("static"));
The class path is also searched for the file (org.jooby.handlers.AssetHandler.loader):
jooby/AssetHandler.java at 1.x · jooby-project/jooby · GitHub
private static Loader loader(final Path basedir, final ClassLoader classloader) {
if (Files.exists(basedir)) {
return name -> {
Path path = basedir.resolve(name).normalize();
if (Files.exists(path) && path.startsWith(basedir)) {
try {
return path.toUri().toURL();
} catch (MalformedURLException x) {
// shh
}
}
return classloader.getResource(name);
};
}
return classloader::getResource;
}
If we send /static/WEB-INF/web.xml it will fail to load it from the file system but will go into classloader.getResource(name) where name equals /WEB-INF/web.xml so will succeed and return the requested file. This way we can get any configuration file or even the application class files
If assets are configured for a certain extension we can still bypass it. eg:
assets("/static/**/*.js", Paths.get("static"));
We can send:
http://localhost:8080/static/io/yiss/App.class.js
Arbitrary class path resource access 2
This vulnerability also affects assets configured to access resources from the root of the class path. eg:
assets("/static/**");
In this case we can traverse static by sending:
http://localhost:8080/static/..%252fio/yiss/App.class
For more information
If you have any questions or comments about this advisory:
- Open an issue in jooby
- Email us at [email protected]
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | io.jooby:jooby | all versions | 2.8.2 |
| ☕Maven | org.jooby:jooby | all versions | 2.8.2 |
Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for io.jooby:jooby. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update io.jooby:jooby to 2.8.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-px9h-x66r-8mpc is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-px9h-x66r-8mpc is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-px9h-x66r-8mpc. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-px9h-x66r-8mpc in your dependencies?
O3 detects GHSA-px9h-x66r-8mpc across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.