CVE-2026-86811 PUBLISHED

Apache TomEE: Path traversal via stateful EJB passivation

Assigner: apache
Reserved: 08.09.2026 Published: 10.11.2026 Updated: 10.11.2026

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Product Status

Vendor Apache Software Foundation
Product Apache TomEE
Versions Default: unaffected
  • affected from 4.0.0-beta-1 to 4.7.5 (incl.)
Vendor Apache Software Foundation
Product Apache TomEE
Versions Default: unaffected
  • affected from 7.0.0-M1 to 10.0.0-M1 (excl.)
  • affected from 10.0.0-M1 to 10.3.0 (excl.)
  • affected from 11.0.0-M1 to 11.0.0-M2 (excl.)

Credits

  • The Apache Software Foundation finder
  • Claude Security tool
  • Markus Jung remediation developer

References

Problem Types

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE