CVE-2026-43975: Java Torealpath Broad Catch Traversal Bypass
Catching a generic `IOException` or `Exception` when calling `toRealPath()` and falling back to `normalize()` can mask symlink validation errors (e.g., AccessDeniedException). If `toRealPath()` fails due to an access exception on a symlink, the fallback path will circumvent symlink resolution, leading to directory traversal vulnerabilities. Catch `NoSuchFile
Javagreprules fetch cve-2026-43975-java-torealpath-broad-catch-traversal-bypass --engine opengrepDescription
Catching a generic `IOException` or `Exception` when calling `toRealPath()` and falling back to `normalize()` can mask symlink validation errors (e.g., AccessDeniedException). If `toRealPath()` fails due to an access exception on a symlink, the fallback path will circumvent symlink resolution, leading to directory traversal vulnerabilities. Catch `NoSuchFile
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.