CVE-2026-54617: GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw

Executive brief

A security vulnerability in GravitLauncher LaunchServer allows unauthorized individuals to access any file on the server. By exploiting this flaw, an attacker can steal sensitive credentials, including private encryption keys and database passwords. This could lead to a complete takeover of the server and all associated user accounts.

Technical details

A path traversal vulnerability exists in the `FileServerHandler.channelRead0` method of GravitLauncher LaunchServer. The application incorrectly handles HTTP request targets that lack a leading slash, causing the `normalize()` function to fail in collapsing '..' sequences. When combined with a `substring(1)` operation and a subsequent `base.resolve(path)` call that lacks re-normalization, an attacker can escape the intended directory. By sending a specially crafted raw HTTP GET request (e.g., `GET ../../.keys/ecdsa_id`), an unauthenticated remote attacker can read sensitive files such as JWT signing keys, database credentials, and system files. This vulnerability is exposed by default on port 9274.

Affected products

• GravitLauncher LaunchServer <= 5.7.11

Timeline

• 2026-05-29: disclosed
• 2026-07-02: advisory

References

• https://api.github.com/users/getclaude
• https://github.com/getclaude
• https://api.github.com/users/getclaude/gists%7B/gist_id%7D
• https://api.github.com/users/getclaude/repos
• https://avatars.githubusercontent.com/u/140894141?v=4
• https://api.github.com/users/getclaude/events%7B/privacy%7D