Quick answers
- Is CVE-2026-111258 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-111258 being exploited in the wild.
- How severe is CVE-2026-111258?
- Informational severity, published 10 November 2026.
- Which products and versions are affected?
- <UNKNOWN>.
- Is there a fix for CVE-2026-111258?
- Yes: fixed in 10.3.0, 11.0.0-M2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-111258 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-111258?
- Check whether you run <UNKNOWN>. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 10.3.0, 11.0.0-M2
Technical details
The request routing feature forwards requests to configured destinations without applying the destination's security constraints or protecting the web application's private directories. If a route copies client-controlled parts of the request path into the destination URL, a remote attacker can perform path traversal to access protected resources, read configuration files, or retrieve compiled class files. The vulnerability requires a specific routing configuration to be exploited.
Affected products
- <UNKNOWN>
Timeline
- 2026-11-10: disclosed