{"id":26090,"date":"2026-09-18T04:32:20","date_gmt":"2026-09-17T20:32:20","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-54617"},"modified":"2026-09-18T04:32:20","modified_gmt":"2026-09-17T20:32:20","slug":"cve-2026-54617","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-54617","title":{"rendered":"CVE-2026-54617 [CRITICAL] &#8211; GravitLauncher is an open-source Minecraft launcher based on sashok724&#8217;s v3. Prior to 5.7."},"content":{"rendered":"<p>GravitLauncher is an open-source Minecraft launcher based on sashok724&#8217;s v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in components\/launchserver\/src\/main\/java\/pro\/gravit\/launchserver\/socket\/handlers\/fileserver\/FileServerHandler.java strips the first request-target character and resolves the remaining path against updatesDir without re-normalizing and verifying containment. This leaves parent-directory components in a no-leading-slash request and allows reading any file accessible to the LaunchServer process, including .keys\/ecdsa_id, .keys\/legacySalt, and LaunchServer.json. Disclosure of those files can expose signing keys, refresh-token material, and database credentials, enabling forged administrative access tokens and full authentication bypass. A normalizing L7 proxy may block the primary request form, but direct exposure and L4\/TCP proxies remain affected, and netty.fileServerEnabled is enabled by default. This issue is fixed in 5.7.12.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>GravitLauncher is an open-source Minecraft launcher based on sashok724&#8217;s v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26090","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26090"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26090"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}