Severity: moderate Affected versions:
- Apache TomEE (org.apache.openejb:openejb-core) 4.0.0-beta-1 through 4.7.5 - Apache TomEE (org.apache.tomee:openejb-core) 7.0.0-M1 before 10.0.0-M1 - Apache TomEE (org.apache.tomee:openejb-core) 10.0.0-M1 before 10.3.0 - Apache TomEE (org.apache.tomee:openejb-core) 11.0.0-M1 before 11.0.0-M2 Description: The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. Credit: The Apache Software Foundation (finder) Claude Security (tool) Markus Jung (remediation developer) References: https://tomee.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-86811
