CVE-2026-86811 - Vulnerability Details - OpenCVE

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache TomEE

unaffected

Version	Status	Constraints
`4.0.0-beta-1`	affected	≤ 4.7.5

Apache Software Foundation

Apache TomEE

unaffected

Version	Status	Constraints
`7.0.0-M1`	affected	< 10.0.0-M1
`10.0.0-M1`	affected	< 10.3.0
`11.0.0-M1`	affected	< 11.0.0-M2

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://lists.apache.org/thread.html/f2x7r654o1nt2z98m39kk0m6x24mz69f

History

Tue, 10 Nov 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Title		Apache TomEE: Path traversal via stateful EJB passivation
Weaknesses		CWE-22
References		https://lists.apache.org/thread.html/f2x7r654o1nt2z98m39kk0m6x24mz69f

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-11-10T14:55:50.983Z

Updated: 2026-11-10T14:55:50.983Z

Reserved: 2026-09-08T13:35:53.402Z

Link: CVE-2026-86811

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-10T15:17:30.193

Modified: 2026-11-10T15:17:30.193

Link: CVE-2026-86811

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-22

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86811", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-08T13:35:53.402Z", "datePublished": "2026-11-10T14:55:50.983Z", "dateUpdated": "2026-11-10T14:55:50.983Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-10T14:55:50.983Z"}, "title": "Apache TomEE: Path traversal via stateful EJB passivation", "problemTypes": [{"descriptions": [{"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "cweId": "CWE-22", "type": "CWE"}]}], "source": {"discovery": "INTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache TomEE", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.openejb:openejb-core", "packageURL": "pkg:maven/org.apache.openejb/openejb-core", "versions": [{"status": "affected", "version": "4.0.0-beta-1", "lessThanOrEqual": "4.7.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache TomEE", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.tomee:openejb-core", "packageURL": "pkg:maven/org.apache.tomee/openejb-core", "versions": [{"status": "affected", "version": "7.0.0-M1", "lessThan": "10.0.0-M1", "versionType": "semver"}, {"status": "affected", "version": "10.0.0-M1", "lessThan": "10.3.0", "versionType": "semver"}, {"status": "affected", "version": "11.0.0-M1", "lessThan": "11.0.0-M2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue."}]}], "references": [{"url": "https://lists.apache.org/thread.html/f2x7r654o1nt2z98m39kk0m6x24mz69f", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}, {"lang": "en", "value": "Claude Security", "type": "tool"}, {"lang": "en", "value": "Markus Jung", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}}}