CVE-2025-11966: eclipse foundation vert.x Cross-site Scripting
Vulnerability summary
CVE-2025-11966 is a medium (CVSS 6.4) Cross-site Scripting vulnerability in eclipse foundation vert.x. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 22-10-2025PublishedVulnerability first disclosed.
- 22-10-2025Last modifiedVulnerability information updated.
Description
In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · WolfiEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
- OSV · ChainguardEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
- OSV · MavenEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
- NVDNIST2.3LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · MavenEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
+0.02 pp
From 0.27% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.eclipse.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Affected systems
Chainguard24 products
- apache-pulsar< 4.1.1-r2
- apache-pulsar-compat< 4.1.1-r2
- kafka_exporter-strimzi-compat< 0.48.0-r1
- kafka-strimzi-compat< 0.48.0-r1
- keycloak-26.2< 26.2.5-r6 | All versions (No fix recorded)
Wolfi17 products
- apache-pulsar< 4.1.1-r2
- apache-pulsar-compat< 4.1.1-r2
- kafka_exporter-strimzi-compat< 0.48.0-r1
- kafka-strimzi-compat< 0.48.0-r1
- keycloak-26.4< 26.4.7-r0
Eclipse1 product
- vert.x≥ 4.0.0, < 4.5.22 | ≥ 5.0.0, < 5.0.5
Eclipse foundation1 product
- vert.x≥ 4.0.0, < 4.5.22 | ≥ 5.0.0, < 5.0.5
Io.vertx1 product
- vertx-web< 4.5.22 | ≥ 5.0.0, < 5.0.5
5 vendors · 44 products
References
5 links- gitlab.eclipse.org/security/vulnerability-reports/-/issues/303REPORTWEBExploitIssue TrackingVendor Advisory
- github.com/vert-x3/vertx-webPACKAGE