Executive brief
Winstone is a lightweight software component used to run Java-based web applications. A security flaw allows unauthorized individuals to bypass folder restrictions and view any file on the underlying server that the application has access to. This could lead to the theft of sensitive configuration files, system passwords, or private customer data, potentially compromising the entire server.
Technical details
A path traversal vulnerability (CWE-22) exists in the Winstone Servlet Engine through version 0.9.10. The vulnerability is rooted in the failure to sanitize 'dot-dot-slash' (../) sequences in HTTP GET requests when serving static files from the configured webroot. An unauthenticated remote attacker can exploit this by sending a single request with traversal-prefixed paths to escape the webroot and read any file accessible to the servlet engine process. If the service is running with elevated privileges, this includes sensitive system files like /etc/shadow. As the project has not been updated since 2008, it is considered unsupported and no official patch is expected.
Affected products
- Rick Knowles Winstone Servlet Container through 0.9.10
Timeline
- 2026-06-25: disclosed: Vulnerability disclosed by Victor A. Morales of GM Sectec
- 2026-06-25: advisory: CVE-2026-56122 published