Cloudanix VulnDB

CVE-2025-11965

None

Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories

CVSS

—

EPSS

0.5%

Published

Oct 22, 2025

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A web server component that was supposed to hide files and folders whose names start with a dot was only checking the last part of the name, so entire hidden folders could still be read by anyone on the internet.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Web Framework
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

StaticHandler with includeHidden=false only inspects the final path segment for a leading dot, allowing files inside hidden directories (such as .git, .env, .aws) to be served when the filename itself lacks a leading dot.

Why it matters to the business

Sensitive configuration files, source code, and credentials stored in conventionally hidden directories become publicly accessible, increasing the risk of credential theft, intellectual-property exposure, and downstream compromise across any Vert.x Web deployment that serves static content.

How an attack unfolds

An attacker enumerates or guesses common hidden-directory names, issues an HTTP GET for paths such as /.git/config or /.env/secrets, and receives the file contents because the handler never inspects parent-directory names for the hidden attribute.

How to fix it

Upgrade vert-x3/vertx-web to commit 188938cb128d55e5897f51ad0b1be283f993a824 or later, or eclipse-vertx/vert.x to commit 81278bc4041d01225ace17944a0f4397ba6ba22f or later; until upgraded, disable StaticHandler or implement a custom filter that blocks any path segment beginning with a dot.

How to confirm the fix worked

Confirm the running version contains one of the listed commits; send test requests for /.git/HEAD and /.secret/test.txt and verify both return 404 or 403; review StaticHandler source for directory-level hidden checks.

Typical attack path

  1. Identify a Vert.x Web application exposing static content via StaticHandler
  2. Request a resource whose path begins with a known hidden directory (/.git/, /.env/, /.aws/) but whose final segment does not start with a dot
  3. Receive the file contents in the HTTP response
  4. Parse the returned data for credentials, keys, or source code

How to detect it

Inspect web-server access logs for GET requests whose URI contains a dot-prefixed directory segment followed by a non-dot filename; correlate with successful 200 responses returning file contents rather than 404 errors.

  • GET /.git/config
  • GET /.env
  • GET /.aws/credentials
  • requests returning 200 for paths containing /.git/, /.env/, or /.aws/

What your security team should do

  • Immediately inventory all Vert.x Web deployments and schedule upgrade to the fixed commits
  • Add web-application-firewall rules that block requests containing /.git/, /.env/, /.aws/ or any dot-prefixed directory segment
  • Scan public-facing endpoints with a directory-traversal or hidden-file scanner to identify exposed instances
  • Review static content trees for accidental placement of secrets inside dot-directories

The record

There is a flaw in the hidden file protection feature of Vert.x Web’s `StaticHandler` when `setIncludeHidden(false)` is configured. In the current implementation, only files whose final path segment (i.e., the file name) begins with a dot (`.`) are treated as “hidden” and are blocked from being served. However, this logic fails in the following cases: - **Files under hidden directories**: For example, `/.secret/config.txt` — although `.secret` is a hidden directory, the file `config.txt` itself does not start with a dot, so it gets served. - **Real-world impact**: Sensitive files placed in hidden directories like `.git`, `.env`, `.aws` may become publicly accessible. As a result, the behavior does not meet the expectations set by the `includeHidden=false` configuration, which should ideally protect all hidden files and directories. This gap may lead to unintended exposure of sensitive information.

Affected packages

Ecosystem Package Introduced Fixed
Maven io.vertx:vertx-web 0 4.5.22
Maven io.vertx:vertx-web 5.0.0 5.0.5
Chainguard apache-pulsar 0 4.1.1-r2
Chainguard apache-pulsar-compat 0 4.1.1-r2
Chainguard apicurio-registry 0 3.1.2-r0
Chainguard apicurio-registry-nginx-config 0 3.1.2-r0
Chainguard apicurio-registry-ui 0 3.1.2-r0
Chainguard kafka-strimzi-compat 0 0.48.0-r1
Chainguard kafka_exporter-strimzi-compat 0 0.48.0-r1
Chainguard keycloak-26.2-compat 0 26.2.5-r6
Chainguard keycloak-26.3-compat 0 26.3.5-r3
Chainguard keycloak-26.3-iamguarded-compat 0 26.3.5-r7
Chainguard keycloak-26.4 0 26.4.7-r0
Chainguard keycloak-26.4-compat 0 26.4.2-r2
Chainguard keycloak-26.4-iamguarded-compat 0 26.4.7-r0
Chainguard keycloak-26.4-operator 0 26.4.7-r0
Chainguard keycloak-26.4-operator-compat 0 26.4.2-r2
Chainguard keycloak-fips-26.3-operator-compat 0 26.3.5-r4
Chainguard keycloak-fips-26.4 0 26.4.7-r12
Chainguard keycloak-fips-26.4-iamguarded-fips 0 26.4.7-r0
Chainguard keycloak-fips-26.4-operator 0 26.4.7-r4
Chainguard keycloak-fips-26.4-operator-compat 0 26.4.4-r1
Chainguard prometheus-jmx-exporter-strimzi-compat 0 0.48.0-r1
Chainguard strimzi-kafka-operator 0 0.48.0-r1
Chainguard strimzi-kafka-operator-cluster-operator 0 0.48.0-r1
Chainguard strimzi-kafka-operator-kafka-agent 0 0.48.0-r1
Chainguard strimzi-kafka-operator-kafka-agent-3 0 0.48.0-r1
Chainguard strimzi-kafka-operator-kafka-base 0 0.48.0-r1
Chainguard strimzi-kafka-operator-kafka-init 0 0.48.0-r1
Chainguard strimzi-kafka-operator-kafka-thirdparty-libs 0 0.48.0-r1
Chainguard strimzi-kafka-operator-kafka-thirdparty-libs-cc 0 0.48.0-r1
Chainguard strimzi-kafka-operator-mirror-maker-agent 0 0.48.0-r1
Chainguard strimzi-kafka-operator-topic-operator 0 0.48.0-r1
Chainguard strimzi-kafka-operator-tracing-agent 0 0.48.0-r1
Chainguard strimzi-kafka-operator-user-operator 0 0.48.0-r1
Wolfi apache-pulsar 0 4.1.1-r2
Wolfi apache-pulsar-compat 0 4.1.1-r2
Wolfi apicurio-registry 0 3.1.2-r0
Wolfi apicurio-registry-nginx-config 0 3.1.2-r0
Wolfi apicurio-registry-ui 0 3.1.2-r0
Wolfi kafka-strimzi-compat 0 0.48.0-r1
Wolfi kafka_exporter-strimzi-compat 0 0.48.0-r1
Wolfi keycloak-26.3-compat 0 26.3.5-r3
Wolfi keycloak-26.3-iamguarded-compat 0 26.3.5-r7
Wolfi keycloak-26.4 0 26.4.7-r0
Wolfi keycloak-26.4-compat 0 26.4.2-r2
Wolfi keycloak-26.4-iamguarded-compat 0 26.4.7-r0
Wolfi keycloak-26.4-operator 0 26.4.7-r0
Wolfi keycloak-26.4-operator-compat 0 26.4.2-r2
Wolfi prometheus-jmx-exporter-strimzi-compat 0 0.48.0-r1
Wolfi strimzi-kafka-operator 0 0.48.0-r1
Wolfi strimzi-kafka-operator-cluster-operator 0 0.48.0-r1
Wolfi strimzi-kafka-operator-kafka-agent 0 0.48.0-r1
Wolfi strimzi-kafka-operator-kafka-agent-3 0 0.48.0-r1
Wolfi strimzi-kafka-operator-kafka-base 0 0.48.0-r1
Wolfi strimzi-kafka-operator-kafka-init 0 0.48.0-r1
Wolfi strimzi-kafka-operator-kafka-thirdparty-libs 0 0.48.0-r1
Wolfi strimzi-kafka-operator-kafka-thirdparty-libs-cc 0 0.48.0-r1
Wolfi strimzi-kafka-operator-mirror-maker-agent 0 0.48.0-r1
Wolfi strimzi-kafka-operator-topic-operator 0 0.48.0-r1
Wolfi strimzi-kafka-operator-tracing-agent 0 0.48.0-r1
Wolfi strimzi-kafka-operator-user-operator 0 0.48.0-r1
maven io.vertx/vertx-web 5.0.0 5.0.5

Related vulnerabilities