Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M
CVE-2026-54617GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler
Critical 9.8
In plain English
A critical-severity path traversal in Launcher from GravitLauncher. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in components/launchserver/src/main/java/pro/gravit/launchserver/socket/handlers/fileserver/FileServerHandler.java strips the first request-target character and resolves the remaining path against updatesDir without re-normalizing and verifying containment. This leaves parent-directory components in a no-leading-slash request and allows reading any file accessible to the LaunchServer process, including .keys/ecdsa_id, .keys/legacySalt, and LaunchServer.json. Disclosure of those files can expose signing keys, refresh-token material, and database credentials, enabling forged administrative access tokens and full authentication bypass. A normalizing L7 proxy may block the primary request form, but direct exposure and L4/TCP proxies remain affected, and netty.fileServerEnabled is enabled by default. This issue is fixed in 5.7.12.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | pro.gravit.launcher:launchserver-api | no fix listed | GHSA-5g75-477j-2c2f |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GravitLauncher | Launcher | < 5.7.12 |
Weakness: CWE-22, CWE-200, CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H