File and Path Handling

Every one of the 27 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Eclipse Mojarra - Local File ReadCVE-2020-6950Eclipse · 10% likely

   CWE-22

2. Eclipse Theia - Unauthenticated Path TraversalCVE-2026-12609Eclipse Foundation · CVSS 7.5 · 1.6% likely

   CWE-22

3. The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download confi…CVE-2018-14371Eclipse · 4.4% likely

   CWE-22

4. In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory…CVE-2020-27216The Eclipse Foundation · 4.4% likely

   CWE-378

5. In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform…CVE-2026-7411Eclipse Foundation · CVSS 10 · 3.7% likely

   CWE-22

6. In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not prope…CVE-2018-12542The Eclipse Foundation · 2.2% likely

   CWE-22

7. Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file writeCVE-2023-4759Eclipse Foundation · CVSS 8.8 · 2.2% likely

   CWE-59

8. In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0.milestone1, 4.0.0.milestone2, 4.0.0.milestone3, 4.0.0.milestone4, 4.0.0.milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHan…CVE-2019-17640The Eclipse Foundation · 2.0% likely

   CWE-23

9. In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially allowing path traversal in get requests for a limited number…CVE-2019-10242The Eclipse Foundation · 2.0% likely

   CWE-22

10. RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.CVE-2018-20227Eclipse · 1.8% likely

    CWE-22

11. Remote Code Execution in Eclipse RAP on WindowsCVE-2023-4760Eclipse Foundation · CVSS 7.6 · 1.3% likely

    CWE-23

12. A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal.CVE-2022-0673Eclipse · 1.0% likely

    CWE-22

13. In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitati…CVE-2022-2712The Eclipse Foundation · CVSS 6.5 · 1.0% likely

    CWE-22

14. Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self…CVE-2026-85199Eclipse Foundation · CVSS 8.8 · 0.9% likely

    CWE-23

15. Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which create…CVE-2021-28168The Eclipse Foundation · CVSS 6.2 · 0.9% likely

    CWE-378

16. An unsafe parsing of OpenMQ's configuration in OpenMQ versions <6.5.2 and <6.9.0, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation c…CVE-2026-24457Eclipse Foundation · CVSS 9.1 · 0.7% likely

    CWE-27

17. In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write…CVE-2026-57898Eclipse Foundation · CVSS 9 · 0.7% likely

    CWE-22

18. In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers…CVE-2026-82217Eclipse Foundation · CVSS 8.8 · 0.6% likely

    CWE-22

19. In Kura versions <= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied directory inside the Kura JVM process before dispatching the c…CVE-2026-97401Eclipse Foundation · CVSS 7.4 · 0.6% likely

    CWE-73

20. In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to…CVE-2026-46581Eclipse Foundation · CVSS 7.5 · 0.6% likely

    CWE-22

21. In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack,…CVE-2026-78299Eclipse Foundation · CVSS 9.1 · 0.5% likely

    CWE-22

22. In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert…CVE-2026-61891Eclipse Foundation · CVSS 7.5 · 0.5% likely

    CWE-36

23. In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to hidden directories,…CVE-2025-11965Eclipse Foundation · CVSS 6.3 · 0.5% likely

    CWE-552

24. In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, th…CVE-2026-79653Eclipse Foundation · CVSS 6 · 0.5% likely

    CWE-22

25. Improper limitation of paths in py-aspect-model-loaderCVE-2026-92610Eclipse Foundation · CVSS 9.8 · 0.4% likely

    CWE-22

26. In Kura versions <= 5.6.2, the "Command" file-upload handler at `POST /admin/denali/file/command` extracts a client-supplied ZIP archive into the configured `command.working.direc…CVE-2026-111729Eclipse Foundation · CVSS 7 · 0.3% likely

    CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.