Relative Path Traversal Affecting io.rest-assured:rest-assured package, versions [,5.2.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Relative Path Traversal vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-IORESTASSURED-21243472
- published19 Oct 2026
- disclosed27 Sept 2026
- creditUnknown
Introduced: 27 Sep 2026
New CVE NOT AVAILABLE CWE-23 (opens in a new tab)How to fix?
Upgrade io.rest-assured:rest-assured to version 5.2.0 or higher.
Overview
Affected versions of this package are vulnerable to Relative Path Traversal in the filter method of FormAuthFilter, which takes the name attribute of the first hidden input on the fetched login page and interpolates it with String.format into the FIND_INPUT_FIELD_WITH_NAME GPath template, a string that XMLAssertion.eval then passes in to GroovyShell.evaluate. An attacker in a MitM position who controls the login page response can execute arbitrary code in the JVM running the test suite by naming that input so the value closes the quoted comparison and appends statements, for example ' }; Runtime.getRuntime().exec(new String[]{'/bin/sh','-c','...'}); x={ ', and no CompilerConfiguration with SecureASTCustomizer constrains the shell, so the full class library including ProcessBuilder, reflection, and file I/O is reachable. This requires the caller to have configured autoDetectCsrfFieldName.