CVE-2026-54617: Unauthenticated Path Traversal in GravitLauncher FileServerHandler Exposes Server Secrets

What's Happening

CVE-2026-54617 is an unauthenticated path traversal vulnerability (CWE-22) in the FileServerHandler component of pro.gravit.launcher:launchserver-api. The handler fails to properly sanitize file path input on its file-serving endpoint, allowing an attacker to supply traversal sequences — ../, URL-encoded variants, or absolute paths — to escape the intended web root and read arbitrary files from the host filesystem.

The impact is arbitrary file read (CWE-200), which in this context frequently means disclosure of sensitive data (CWE-522) such as server configuration files, private keys, and authentication databases. Because the endpoint requires no authentication and the flaw carries a CVSS score of 9.8, this is a critical, low-effort attack path for a remote, unauthenticated adversary.

Affected Software

• Package: pro.gravit.launcher:launchserver-api (Maven)
• Affected versions: <= 5.7.11
• Patched version: not yet published at time of writing

Exploitation Status

A public proof-of-concept is available for this vulnerability. There is no indication yet that it is in CISA's Known Exploited Vulnerabilities (KEV) catalog or being actively weaponized in the wild, but public PoC availability significantly lowers the bar for exploitation and typically precedes broader adoption by opportunistic scanners and automated attack tooling. Defenders running unpatched LaunchServer instances should treat this as an active, near-term risk rather than a theoretical one.

How Our Detection Works

We ship detection logic for this vulnerability across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL).

At a high level, the detection logic inspects HTTP requests directed at the LaunchServer file-serving endpoint and flags requests whose path parameters contain traversal indicators — literal ../ sequences, their URL-encoded equivalents, double-encoded variants, and absolute filesystem paths. The rules correlate on request path structure and encoding anomalies rather than static string matching alone, which helps surface obfuscated traversal attempts designed to evade naive filtering, while minimizing noise from legitimate file requests.

Full Detection Details

For the complete detection logic, including the KQL, SPL, and other SIEM queries, view the full detection page for CVE-2026-54617.