CVE-2026-19032 | CVSS: 5.3 | 严重级别: MEDIUM
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a default JsonM
参考链接:
• https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e04
• https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ff
• https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909a
📌 数据来源: NVD 官方