CVE-2026-56122 is a path traversal vulnerability in the Winstone Servlet Container (up to version 0.9.10) that permits unauthenticated remote attackers to read arbitrary files on the server. The vulnerability arises from improper sanitization of pathname inputs containing traversal sequences (../) in HTTP GET requests targeting static files. Attackers can bypass the webroot restriction and access any file readable by the servlet engine process, potentially exposing sensitive data, especially if the service operates with elevated privileges. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation allows an unauthenticated attacker to read any file accessible to the Winstone Servlet Engine process, including sensitive system files if the service runs with elevated privileges. This can lead to significant confidentiality breaches. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Winstone Servlet Engine and consider running the service with least privilege to minimize potential impact. Monitor vendor channels for updates regarding a patch or official mitigation.