In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path can craft filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that executes in the context of users viewing the affected directory listing.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], when "directory listing" is enabled, file
    and directory names are inserted into generated HTML without proper escaping in the href, title, and link
    attributes. An attacker who can create or rename files or directories within a served path can craft
    filenames containing malicious script or HTML content, leading to stored cross-site scripting (XSS) that
    executes in the context of users viewing the affected directory listing. (CVE-2025-11966)

ID	Name	Product	Family	Type	Severity
464514	Echo: io.vertx:vertx-web, vertx-web: security update to 4.5.22	Tenable Cloud Security	Echo Local Security Checks	Local	low
464514	Echo: io.vertx:vertx-web, vertx-web: security update to 4.5.22	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
435728	SCA: security update for io.vertx:vertx-web (GHSA-45p5-v273-3qqr)	Tenable Cloud Security	SCA Checks	Local	low
435728	SCA: security update for io.vertx:vertx-web (GHSA-45p5-v273-3qqr)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2025-11966

low

Tenable Plugins

low

low

low

low