Threats affecting pkg:maven/org.apache.juneau/juneau-commons

CVE-2026-121489 is a critical path traversal vulnerability in Apache Juneau affecting versions prior to 9.2.1. The DirectoryResource microservice fails to restrict request paths to its configured root directory, allowing clients to read, write, or delete files outside the intended directory when certain resource settings are enabled. This flaw is fixed in version 9.2.1.