Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Jetty Use of Non-Canonical URL Paths for Authorization Decisions Vulnerability - CVE-2026-8384 - Vulnerability Database
Jetty

Jetty Use of Non-Canonical URL Paths for Authorization Decisions Vulnerability - CVE-2026-8384

Medium
Reference: CVE-2026-8384
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-8384
Title: Jetty Use of Non-Canonical URL Paths for Authorization Decisions Vulnerability
Overview:

In Eclipse Jetty an HTTP URI of this form: /public/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.