CVE-2024-36117: Path Traversal in Reposilite Backend

The vulnerability lies in the handling of expanded javadoc files within the /javadoc/{repository}/<gav>/raw/<resource> endpoint. An attacker can craft a malicious <resource> path containing path traversal sequences (e.g., ../..) to navigate outside the intended javadocUnpackPath directory. This allows them to read files they shouldn't have access to, such as configuration files, source code, or other sensitive data stored on the server. The potential impact includes data breaches, compromise of credentials, and potential for further exploitation if sensitive files contain valuable information. This vulnerability shares similarities with other path traversal exploits where attackers leverage predictable file paths to gain unauthorized access.

1. Reserved2024-05-20
2. Published2024-11-04
3. Modified2024-11-05
4. EPSS updated2026-04-02

The primary mitigation is to upgrade Reposilite Backend to version 3.5.12 or later, which includes the fix for this vulnerability. If upgrading immediately is not possible, consider implementing temporary workarounds. One approach is to restrict access to the /javadoc endpoint to trusted users or networks. Another is to implement input validation on the <resource> parameter to prevent path traversal sequences. Additionally, consider using a Web Application Firewall (WAF) to filter requests containing suspicious path characters. After upgrading, verify the fix by attempting to access a file outside the intended javadocUnpackPath directory via the /javadoc endpoint; the request should be denied.