{"id":"CVE-2026-54617","title":"GravitLauncher is an open-source Minecraft launcher based on sashok724's v3","summary":"GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-22","CWE-200","CWE-522"],"vendor":"GravitLauncher","product":"Launcher","affected":["Launcher < 5.7.12"],"published":"2026-09-17","updated":"2026-09-24","sourceUpdated":"2026-09-24T21:25:27.050","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54617","references":[{"url":"https://github.com/GravitLauncher/Launcher/commit/8114a1d4cfbcaab4c1c337d921597805d71dee3b","label":"security-advisories@github.com"},{"url":"https://github.com/GravitLauncher/Launcher/releases/tag/v5.7.12","label":"security-advisories@github.com"},{"url":"https://github.com/GravitLauncher/Launcher/security/advisories/GHSA-5g75-477j-2c2f","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-5g75-477j-2c2f"}],"tags":["nvd","cve.org","ghsa","maven"],"epss":0.01086,"epssPercentile":0.63791,"ecosystem":"maven","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-18T17:32:35.745645Z"},"ingestedAt":"2026-07-02T21:44:45.091Z","slug":"CVE-2026-54617","body":"## Overview\n\nGravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in components/launchserver/src/main/java/pro/gravit/launchserver/socket/handlers/fileserver/FileServerHandler.java strips the first request-target character and resolves the remaining path against updatesDir without re-normalizing and verifying containment. This leaves parent-directory components in a no-leading-slash request and allows reading any file accessible to the LaunchServer process, including .keys/ecdsa_id, .keys/legacySalt, and LaunchServer.json. Disclosure of those files can expose signing keys, refresh-token material, and database credentials, enabling forged administrative access tokens and full authentication bypass. A normalizing L7 proxy may block the primary request form, but direct exposure and L4/TCP proxies remain affected, and netty.fileServerEnabled is enabled by default. This issue is fixed in 5.7.12.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54617)\n\nAffected packages:\n\n- `pro.gravit.launcher:launchserver-api <= 5.7.11`\n\nSource: https://github.com/advisories/GHSA-5g75-477j-2c2f","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}