CVE-2026-114370 Red Hat CVE debrief

Who should care

Defenders responsible for configuring and securing Undertow web servers, particularly those serving static files from the file system, should assess exposure and prioritize verification of affected versions and configurations.

Why it matters

Defenders should care about CVE-2026-114370 because it allows an attacker to access files in a sibling directory via a symbolic link, potentially leading to unauthorized access to sensitive information. Those responsible for configuring and securing Undertow web servers should assess exposure and prioritize verification of affected versions and configurations.

• Potential unauthorized access to sensitive files
• Possible data breaches or exposure of sensitive information
• Need for verification of affected versions and configurations
• Prioritization of patching or mitigating vulnerable deployments

Technical summary

The PathResourceManager component of the Undertow web server is vulnerable to a symbolic link traversal attack. An attacker could access files in a sibling directory by exploiting this flaw. This issue arises from the mechanism used to verify if a symbolic link points to a safe location only checking if the target path starts with a specific string, without ensuring it matches a full directory name. Defenders should prioritize verifying affected versions and configurations of the Undertow web server, particularly in deployments serving static files from the file system.

Defensive priority

Defenders should prioritize verifying affected versions and configurations of the Undertow web server, particularly in deployments serving static files from the file system.

Recommended defensive actions

• Verify affected versions and configurations of the Undertow web server
• Assess exposure in deployments serving static files from the file system
• Review and update PathResourceManager component configurations to ensure safe directory checks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Red Hat has also provided a security advisory for this CVE. Defenders should verify affected versions and configurations of the Undertow web server, particularly in deployments serving static files from the file system, and assess exposure. Evidence is limited to public sources, and further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.