CVE-2023-24815: StaticHandler disclosure of classpath resources on Windows when mounted on a wildcard route in io.vertx:vertx-web
Summary
CVE-2023-24815: StaticHandler disclosure of classpath resources on Windows when mounted on a wildcard route. Affects io.vertx:vertx-web versions >= 4.0.0, < 4.3.8. Fixed in 4.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
io.vertx:vertx-web is a web framework for building reactive web applications on the Vert.x toolkit. It provides various components and utilities for handling HTTP requests and serving static files. The StaticHandler class is responsible for serving static files from the file system or classpath.
Vulnerability Detail
The vulnerability (CVE-2023-24815) allows an attacker to exfiltrate any classpath resource when running vertx web applications on Windows Operating Systems and Windows File Systems. When the mount point is a wildcard (*), the code does not properly handle backslashes (\) in the user input, allowing an attacker to construct a path that is valid within the classpath. This can lead to unauthorized access to sensitive resources and potential information disclosure.
How To Fix
Latest published version: 5.2.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.3.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to avoid using wildcard mount points (*) with StaticHandler on Windows systems. Instead, specify the exact mount point for serving static files.
Conclusion
The vulnerability in io.vertx:vertx-web allows an attacker to exfiltrate classpath resources when using wildcard mount points on Windows systems. It is crucial to upgrade to version 4.3.8 or later to mitigate this issue. As always, it is recommended to stay updated with the latest security patches and follow best practices for secure web application development. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.vertx:vertx-web →
FAQ
The vulnerability allows an attacker to access and exfiltrate any classpath resource, potentially leading to unauthorized access to sensitive information.
Versions 4.0.0 through 4.3.7 of io.vertx:vertx-web are affected by this vulnerability.
Yes, the CVSS score for this vulnerability is 4.8 (Medium).
No, this vulnerability specifically affects Windows Operating Systems and Windows File Systems.
Yes, as a temporary workaround, it is advised to avoid using wildcard mount points (*) with StaticHandler on Windows systems.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.vertx:vertx-web.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
