CVE-2025-11966

CVE-2025-11966 is a stored cross-site scripting (XSS) vulnerability affecting Eclipse Vert.x versions 4.0.0-4.5.21 and 5.0.0-5.0.4 when directory listing is enabled. An attacker can craft malicious filenames or directory names, which are then improperly escaped in the generated HTML, leading to script execution in the context of users viewing the directory listing. Rated as Medium severity (CVSS 6.4), this vulnerability requires an attacker to have write access to the served path, but exploitation is straightforward once that condition is met, potentially leading to information disclosure and integrity compromise. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.