/Vulnerability Library

GravitLauncher LaunchServer <=5.7.11 - Unauthenticated Path Traversal to Arbitrary File Read

CVE-2026-54617
Early Release

Description

LaunchServer's Netty FileServerHandler computes the served path by stripping one leading character on the assumption that every request-target begins with '/'. Netty's HttpServerCodec accepts a request-target without a leading slash verbatim, so a request without a leading slash bypasses path normalization and escapes the updatesDir. The file server is enabled by default (netty.fileServerEnabled=true) on 0.0.0.0:9274 with no authentication, allowing an unauthenticated remote GET to read any file readable by the LaunchServer process including its own ECDSA signing key (.keys/ecdsa_id), which signs access JWTs and enables full authentication bypass for any account.

Severity

Critical

CVSS Score

9.8

Exploit Probability

1%

Affected Product

launchserver

Published Date

September 11, 2026

Template Author

str4k3r

CVE-2026-54617.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-54617
CWE ID:
cwe-22

References

https://github.com/GravitLauncher/Launcher/security/advisories/GHSA-5g75-477j-2c2fhttps://github.com/GravitLauncher/Launcher/commit/1e0b3a3

Remediation Steps

Upgrade GravitLauncher LaunchServer to a version newer than 5.7.11.