CVE-2026-93649
7.5HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-494, CWE-601
Impact
Attackers can deliver arbitrary malicious binaries to users visiting legitimate-looking adoptium.net links. An attacker needs a user to click a crafted download link.
Root cause
The download page validates the destination URL with String.startsWith() without normalizing RFC 3986 dot-segments, allowing path traversal past the trusted prefix check before browser redirection.
Affected systems
Eclipse Adoptium website (adoptium.net) deployments built from commit 0b24ea1 up to commit cbb53cf.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Fix & remediation
Deploy the website using commit cbb53cf or later; no interim configuration mitigation is specified.
$ git pull origin main && git checkout cbb53cf4a41f068a70902217473d7e2fe5d6c6adAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta http-equiv="refresh". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine "Thank you for downloading Eclipse Temurin" page while their browser downloads a binary of the attacker's choosing