{"api_version":"1","generated_at":"2026-11-10T15:49:14+00:00","cve":"CVE-2026-86811","urls":{"html":"https://cve.report/CVE-2026-86811","api":"https://cve.report/api/cve/CVE-2026-86811.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-86811","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-86811"},"summary":{"title":"Apache TomEE: Path traversal via stateful EJB passivation","description":"The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-10 15:17:30","updated_at":"2026-11-10 15:17:30"},"problem_types":["CWE-22","CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread.html/f2x7r654o1nt2z98m39kk0m6x24mz69f","name":"https://lists.apache.org/thread.html/f2x7r654o1nt2z98m39kk0m6x24mz69f","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86811","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86811","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 4.0.0-beta-1 4.7.5 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 7.0.0-M1 10.0.0-M1 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 10.0.0-M1 10.3.0 semver","platforms":[]},{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache TomEE","version":"affected 11.0.0-M1 11.0.0-M2 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"The Apache Software Foundation","lang":"en"},{"source":"CNA","value":"Claude Security","lang":"en"},{"source":"CNA","value":"Markus Jung","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.openejb:openejb-core","packageURL":"pkg:maven/org.apache.openejb/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"4.7.5","status":"affected","version":"4.0.0-beta-1","versionType":"semver"}]},{"collectionURL":"https://repo.maven.apache.org/maven2","defaultStatus":"unaffected","packageName":"org.apache.tomee:openejb-core","packageURL":"pkg:maven/org.apache.tomee/openejb-core","product":"Apache TomEE","vendor":"Apache Software Foundation","versions":[{"lessThan":"10.0.0-M1","status":"affected","version":"7.0.0-M1","versionType":"semver"},{"lessThan":"10.3.0","status":"affected","version":"10.0.0-M1","versionType":"semver"},{"lessThan":"11.0.0-M2","status":"affected","version":"11.0.0-M1","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"The Apache Software Foundation"},{"lang":"en","type":"tool","value":"Claude Security"},{"lang":"en","type":"remediation developer","value":"Markus Jung"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"value":"The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T14:55:50.983Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/f2x7r654o1nt2z98m39kk0m6x24mz69f"}],"source":{"discovery":"INTERNAL"},"title":"Apache TomEE: Path traversal via stateful EJB passivation","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-86811","datePublished":"2026-11-10T14:55:50.983Z","dateReserved":"2026-09-08T13:35:53.402Z","dateUpdated":"2026-11-10T14:55:50.983Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 15:17:30","lastModifiedDate":"2026-11-10 15:17:30","problem_types":["CWE-22","CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"86811","Ordinal":"1","Title":"Apache TomEE: Path traversal via stateful EJB passivation","CVE":"CVE-2026-86811","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"86811","Ordinal":"1","NoteData":"The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","Type":"Description","Title":"Apache TomEE: Path traversal via stateful EJB passivation"}]}}}