CVE-2026-54617

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in components/launchserver/src/main/java/pro/gravit/launchserver/socket/handlers/fileserver/FileServerHandler.java strips the first request-target character and resolves the remaining path against updatesDir without re-normalizing and verifying containment. This leaves parent-directory components in a no-leading-slash request and allows reading any file accessible to the LaunchServer process, including .keys/ecdsa_id, .keys/legacySalt, and LaunchServer.json. Disclosure of those files can expose signing keys, refresh-token material, and database credentials, enabling forged administrative access tokens and full authentication bypass. A normalizing L7 proxy may block the primary request form, but direct exposure and L4/TCP proxies remain affected, and netty.fileServerEnabled is enabled by default. This issue is fixed in 5.7.12.

• CWE-22
• CWE-200
• CWE-522

• https://github.com/GravitLauncher/Launcher/commit/8114a1d4cfbcaab4c1c337d921597805d71dee3b
• https://github.com/GravitLauncher/Launcher/releases/tag/v5.7.12
• https://github.com/GravitLauncher/Launcher/security/advisories/GHSA-5g75-477j-2c2f

Published

Sep 17, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54609QTI Neon is a minimal, game-agnostic, relay-based UDP multip…8.6
• CVE-2026-54611InstantCMS is a free and open source content management syst…5.5
• CVE-2026-54612Vvveb is a powerful and easy to use CMS with page builder to…8.8
• CVE-2026-54613Vvveb is a powerful and easy to use CMS with page builder to…5.4
• CVE-2026-54614DebugKit provides a debugging toolbar for CakePHP applicatio…4.3
• CVE-2026-54616NanaZip is the 7-Zip derivative intended for the modern Wind…7.1
• CVE-2026-54618Obsidian Web MCP is a secure remote MCP server for Obsidian …9.4
• CVE-2026-54619sqlite3 provides Ruby bindings for the SQLite3 embedded data…2
• CVE-2026-5462A vulnerability was identified in Wahoo Fitness SYSTM App up…3.3
• CVE-2026-54620sqlite3 provides Ruby bindings for the SQLite3 embedded data…2
• CVE-2026-54621datamodel-code-generator generates Python data models from s…7.8
• CVE-2026-54622django CMS is an easy-to-use and developer-friendly enterpri…6.5