path traversal in Jooby
Impact
Access to sensitive information available from classpath.
Patches
Patched version: 1.6.7 and 2.8.2
Commit 1.x: https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009
Commit 2.x: https://github.com/jooby-project/jooby/commit/c81479de67036993f406ccdec23990b44b0bec32
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
References
Latest 1.x version: 1.6.6
Arbitrary class path resource access 1
When sharing a File System directory as in:
assets("/static/**", Paths.get("static"));The class path is also searched for the file (org.jooby.handlers.AssetHandler.loader):
jooby/AssetHandler.java at 1.x · jooby-project/jooby · GitHub
private static Loader loader(final Path basedir, final ClassLoader classloader) {
if (Files.exists(basedir)) {
return name -> {
Path path = basedir.resolve(name).normalize();
if (Files.exists(path) && path.startsWith(basedir)) {
try {
return path.toUri().toURL();
} catch (MalformedURLException x) {
// shh
}
}
return classloader.getResource(name);
};
}
return classloader::getResource;
}If we send /static/WEB-INF/web.xml it will fail to load it from the file system but will go into classloader.getResource(name) where name equals /WEB-INF/web.xml so will succeed and return the requested file. This way we can get any configuration file or even the application class files
If assets are configured for a certain extension we can still bypass it. eg:
assets("/static/**/*.js", Paths.get("static"));We can send:
http://localhost:8080/static/io/yiss/App.class.jsArbitrary class path resource access 2
This vulnerability also affects assets configured to access resources from the root of the class path. eg:
assets("/static/**");In this case we can traverse static by sending:
http://localhost:8080/static/..%252fio/yiss/App.classFor more information
If you have any questions or comments about this advisory:
- Open an issue in jooby
- Email us at support@jooby.io
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | io.jooby:jooby | < 2.8.2 | 2.8.2 |
| Java / Kotlin (Maven) | org.jooby:jooby | < 2.8.2 | 2.8.2 |
References
- https://github.com/jooby-project/jooby/security/advisories/GHSA-px9h-x66r-8mpc
- https://nvd.nist.gov/vuln/detail/CVE-2020-7647
- https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009
- https://github.com/jooby-project/jooby
- https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-568806
- https://snyk.io/vuln/SNYK-JAVA-IOJOOBY-568806,
- https://snyk.io/vuln/SNYK-JAVA-ORGJOOBY-568807
- https://snyk.io/vuln/SNYK-JAVA-ORGJOOBY-568807,
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-22- Platform
- Java / Kotlin (Maven)
- Package
io.jooby:jooby, org.jooby:jooby- Disclosed
- 13.05.2020
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-px9h-x66r-8mpc - CC BY 4.0
Vulnerability history: org.jooby:jooby
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 08.2019 05.2020
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 2
Disclosures per year
- 2019: 1
- 2020: 1
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
path traversal in Jooby this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.