Vulnerability · Published Oct 22, 2025 · Assigned by eclipse
CVE-2025-11966
Low 2.3
In plain English
A low-severity cross-site scripting in Vert.x from Eclipse Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | io.vertx:vertx-web | 4.5.22 | GHSA-45p5-v273-3qqr |
| Maven | io.vertx:vertx-web | 5.0.5 | GHSA-45p5-v273-3qqr |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Vert.x | 4.0.0 – before 4.5.225.0.0 – before 5.0.5 |
Weakness: CWE-79, CWE-80 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N