Unscored severity · published Dec 1, 2014
CVE-2014-7816
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to…
–
CVSS
25.1%
EPSS
No
On KEV
Description
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.
Exploitation
Is it being used?
Exploit prediction (EPSS)25.1% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
Undertow · Redhat
through 1.0.16; through 1.1.0; through 1.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7816
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7816
seclists.org
http://seclists.org/oss-sec/2014/q4/830
www.securityfocus.com
http://www.securityfocus.com/bid/71328
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1157478
Vendor Advisory
https://issues.jboss.org/browse/UNDERTOW-338
Vendor Advisory
https://issues.jboss.org/browse/WFLY-4020
More from Undertow
9.8
CVE-2020-1745
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in…
9.8
CVE-2019-10212
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security
9.8
CVE-2019-3888
A vulnerability was found in Undertow web server before 2.0.21
9.6
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
9.1
CVE-2026-28369
Undertow: undertow: request smuggling via malformed http request headers