Vulnerability · Published Jun 25, 2026 · Assigned by VulnCheck

CVE-2026-56122Winstone Servlet Engine 0.9.10 Path Traversal via HTTP Request Paths

High 7.5

In plain English

A high-severity path traversal in Winstone Servlet Container from rickknowles. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 53.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the configured webroot. Attackers can traverse outside the webroot directory using traversal-prefixed paths in a single HTTP request to read any file accessible to the servlet engine process, including sensitive system files when the service runs with elevated privileges.

Affected products (as reported)

Vendor	Product	Versions
rickknowles	Winstone Servlet Container	0 – through 0.9.10

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://gist.github.com/VAMorales/ce93f10215c43b2a8344426f4dd59cd3 technical-description, exploit
https://winstone.sourceforge.net/ product
https://www.vulncheck.com/advisories/winstone-servlet-engine-path-traversal-via-http-request-paths third-party-advisory