CVE-2025-11966

What it actually does

In StaticHandlerImpl#sendDirectoryListing, file and directory names are inserted unescaped into href, title, link text, and template placeholders under the text/html branch, enabling arbitrary HTML/JavaScript injection when directory listings are rendered.

Why it matters to the business

Organizations using affected Vert.x web versions risk client-side script execution against users who browse directory listings, which can lead to credential theft, session hijacking, or unauthorized actions within the application context; the issue has been public for over a year with no known ransomware use but remains exploitable until patched.

How an attack unfolds

An attacker with write access to a served directory creates a file or subdirectory whose name contains HTML or JavaScript payloads; when a victim requests the directory listing page, the handler embeds the unescaped name into the generated HTML, causing the browser to execute the injected code.

How to fix it

Upgrade vert-x3/vertx-web to the version containing commit 188938cb128d55e5897f51ad0b1be283f993a824 or eclipse-vertx/vert.x to the version containing commit 81278bc4041d01225ace17944a0f4397ba6ba22f; disable directory listings where feasible until the update is applied.

How to confirm the fix worked

Confirm the presence of the fixed commits in the deployed StaticHandlerImpl.java, re-test directory listings with filenames containing angle brackets and script tags to verify escaping, and review release notes for the referenced commits.

Typical attack path

1. Obtain write access to a directory served by StaticHandler
2. Create a file or folder whose name contains HTML/JavaScript payload
3. Trigger a request to the directory listing endpoint
4. Victim browser parses and executes the injected script from the rendered page

How to detect it

Review web access logs for requests to directory listing paths; search application or proxy logs for filenames containing HTML tags, script elements, or encoded angle brackets; inspect rendered HTML responses for unescaped file names in anchor or list elements.

• file names containing <script
• directory listing responses with unescaped href or title attributes
• HTTP requests to paths ending in / that return HTML containing raw angle brackets from filenames

What your security team should do

• Apply the listed commits or newer releases immediately
• Audit all deployments for enabled directory listings and restrict where possible
• Add automated scanning for unescaped template variables in custom handlers
• Monitor for new downstream dependents that may still ship vulnerable versions