CVE-2026-121489 is a critical path traversal vulnerability in Apache Juneau affecting the DirectoryResource microservice. When enabled, the resource's view, upload, or delete settings allow clients to access files outside the configured root directory, potentially reading, writing, or deleting any file accessible by the server process. This flaw affects Apache Juneau versions through 9.2.0 and is fixed in version 9.2.1.