CVE-2025-11966 Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names
Stored XSS in Eclipse Vert.x directory listing allows attackers to execute scripts via crafted filenames when directory listing is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11966?
CVE-2025-11966 is a low-severity cross-site scripting vulnerability in Eclipse Foundation Vert.x, published on 22 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.
Which versions are affected by CVE-2025-11966?
4 open source packages ship an affected version, including io.vertx:vertx-web. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.vertx:vertx-web Maven | All versions | 4.5.22 |
io.vertx:vertx-web Maven | All versions | 4.5.22 |
io.vertx:vertx-web Maven | From 5.0.0 | 5.0.5 |
io.vertx:vertx-web Maven | From 5.0.0 | 5.0.5 |
Products include Eclipse Vert.x.
How do I fix CVE-2025-11966?
Upgrade io.vertx:vertx-web to a fixed version for your release line: 4.5.22 or 5.0.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-11966 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11966 exists.
Other vulnerabilities in Eclipse Foundation Vert.x
- CVE-2019-17640 Path Traversal in Eclipse Vert
- CVE-2018-12542 Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location
- CVE-2018-12544 Moderate severity vulnerability that affects io.vertx:vertx-core
- CVE-2026-102469 Deserialization in Eclipse Vert.x
- CVE-2018-12540 High severity vulnerability that affects io.vertx:vertx-web
Sources
Also known as CLEANSTART-2026-AL62330, CLEANSTART-2026-CW98636, CLEANSTART-2026-LY97922, ECHO-4377-3f2b-771f, GHSA-45p5-v273-3qqr, MINI-2v9v-h8mx-w265 and 5 more.