CVE-2025-11965: io.vertx:vertx-web Access Control Flaw in StaticHandler's Hidden File Protection
Summary
CVE-2025-11965: Description There is a flaw in the hidden file protection feature of Vert.x Web’s StaticHandler when setIncludeHidden(false) is configured. Affects io.vertx:vertx-web across 2 version ranges.
< 4.5.22
>= 5.0.0, < 5.0.5
Fixed in 4.5.22 or 5.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vert.x Web is a framework for building reactive web applications on the JVM. It provides a set of tools for handling HTTP requests, routing, and serving static files. One of its key features is the StaticHandler, which serves static content from the file system. However, a flaw in its hidden file protection mechanism can lead to unintended exposure of sensitive files.
Vulnerability Detail
The vulnerability arises from a flaw in the hidden file protection feature of Vert.x Web's StaticHandler when configured with setIncludeHidden(false). The implementation only blocks files whose names start with a dot, failing to protect files located in hidden directories. This can lead to sensitive files, such as configuration files in .git or .env directories, being publicly accessible, which contradicts the intended behavior of the configuration.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.5.224.5.22 -
>= 5.0.0, < 5.0.55.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can manually implement additional checks in your application to prevent access to files in hidden directories. For example, you can modify the StaticHandler configuration to include custom logic that checks for hidden directories before serving files.
Conclusion
The CVE-2025-11965 vulnerability in io.vertx:vertx-web poses a significant risk by allowing access to sensitive files in hidden directories. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for io.vertx:vertx-web →
FAQ
CVE-2025-11965 is a vulnerability in the io.vertx:vertx-web package that allows sensitive files in hidden directories to be accessed when they should be protected.
If your application uses Vert.x Web's StaticHandler with setIncludeHidden(false), sensitive files in hidden directories may be exposed, leading to potential data breaches.
Versions of io.vertx:vertx-web prior to 4.5.22 and between 5.0.0 and 5.0.4 are affected by this vulnerability.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. By simply using your pom.xml, you can check if your application is affected by this vulnerability without requiring access to the code or installation.
If you cannot update the package, implement additional checks in your application to prevent access to files in hidden directories as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for io.vertx:vertx-web.
