Executive brief
Apache Shiro is a widely-used authentication and authorization framework for Java applications. On case-insensitive filesystems (such as macOS), an attacker can bypass Shiro's static file access controls by varying the case of requested filenames, potentially accessing restricted resources that should be blocked by security filters.
Technical details
This is a path traversal / access control bypass vulnerability affecting Apache Shiro's static file serving. The root cause is that Shiro's filter chain comparison is case-sensitive (typically configured with lowercase patterns), but when static files are served from case-insensitive filesystems, an attacker can request the same file using alternate casing (e.g., /Admin/Config.txt instead of /admin/config.txt) to circumvent lowercase-only filter rules. No authentication is required; the attack is a simple HTTP request with case variation. An attacker gains unauthorized access to protected static files. Patches are available: Shiro 2.0.7 and later, with case-insensitive filter support added in 2.1.0 and made default from 3.0.0 onward.
Affected products
- Apache Shiro before 2.0.7
Timeline
- 2026-02-09: disclosed: CVE-2026-23903 published
- 2026-02-09: patched: Fixed in Shiro 2.0.7