CVE-2022-2712: Path Traversal In Eclipse GlassFish
Summary
CVE-2022-2712: Path Traversal In Eclipse GlassFish. Affects org.glassfish.main.web:web versions >= 5.1.0, < 7.0.0. Fixed in 7.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse GlassFish is an open-source application server that provides a runtime environment for Java EE applications. It offers features such as web services, security, and clustering. The 'org.glassfish.main.web:web' package is a component of Eclipse GlassFish responsible for handling web-related functionality. This package is vulnerable to a path traversal attack, allowing remote unauthenticated attackers to access critical data, including configuration files and deployed application source code.
Vulnerability Detail
The vulnerability exists in Eclipse GlassFish versions 5.1.0 to 6.2.5. It stems from a lack of proper filtering of request paths starting with './', which allows an attacker to traverse the file system and access sensitive files. Successful exploitation of this vulnerability can lead to unauthorized access to critical data, potentially compromising the confidentiality and integrity of the system.
How To Fix
Latest published version: 9.0.0-M3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually filtering request paths starting with './'. This can be achieved by modifying the code responsible for handling incoming requests and validating the path before processing it. Here is an example of how the workaround can be implemented in Java:
String requestPath = getRequestPath();
if (!requestPath.startsWith("./")) {
// Process the request
} else {
// Handle the invalid path
}
Conclusion
In conclusion, the path traversal vulnerability in Eclipse GlassFish versions 5.1.0 to 6.2.5 can lead to unauthorized access to critical data. It is crucial to upgrade to version 7.0.0 or later to mitigate the risk. If immediate upgrade is not possible, implementing the provided workaround can help protect against exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.glassfish.main.web:web →
FAQ
The vulnerability allows remote unauthenticated attackers to access critical data, such as configuration files and deployed application source code. This can lead to unauthorized disclosure of sensitive information and potential compromise of the system's integrity.
Users of Eclipse GlassFish versions 5.1.0 to 6.2.5 are affected by this vulnerability. It is important to upgrade to version 7.0.0 or later to mitigate the risk.
No, authentication is not required. Remote unauthenticated attackers can exploit this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is crucial to apply the necessary fixes to prevent potential exploitation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file to provide accurate vulnerability information.
