jvc
July 13, 2026, 9:49am
1
Hello I have spotted the recent CVE-2026-29519 . I cant find any mention of the this CVE in Jira Lucee Dev or in this forum.
Only a small number of Lucee 6.2 versions are listed as vulnerable incl. 6.2.3.35 and no 6.2s are listed as not vulnerable.
Quick testing reveals our 6.2 Apps to not be vulnerable in situ. but that does mean the underlying Lucee version is not.
Does anyone know if this issue has been addressed in any releases post 6.2.3.35 ?
If this is the wrong channel for this sort of question, let me know
Many thanks.
JC
@jvc ,missinginclude error without JavaScript execution.https://luceeserver.atlassian.net/browse/LDEV-3027
I’ve submitted a PR for this issue:
lucee:7.0 ← allanoepping:LDEV-3027-missinginclude-path-xss
opened 07:51PM - 13 Aug 26 UTC
## Summary
Fixes the reflected XSS in URL path parsing tracked as **LDEV-3027**… / **CVE-2026-29519**.
When a requested template cannot be found, Lucee raises a `MissingIncludeException` whose message and detail embed the requested path (`PageSource.getRealpathWithVirtual()` / `getDisplayPath()`). That text is rendered into the detailed error page unescaped, so an HTML/JS payload placed in a URL path segment executes in the victim's browser, e.g.:
```
http://host/foo/<img src=x onerror=alert(1)>/index.cfm/
```
The issue affects the 5.3.x, 6.1.x, 6.2.x and 7.0.x lines.
## Fix
HTML-escape the requested path with `StringUtil.escapeHTML` at the single points where untrusted request-path data enters the exception message and detail — mirroring the existing escaping of the REST 404 path in `PageContextImpl` (`HTMLEntities.escapeHTML(pathInfo)`). Null-guarded with `StringUtil.emptyIfNull`, since `escapeHTML` NPEs on a null argument.
## Test
Adds `test/tickets/LDEV3027.cfc`: triggers the exception via a payload-bearing missing include and asserts the message/detail contain no raw tag-open (`<img`, `<script>`) and instead the escaped form (`<img`, `<script>`). Passes locally with `mvn test -DtestFilter=LDEV3027`.
## Notes
- Targets `7.0` (active stable). Backport candidate for the `6.2` LTS line and the other affected branches.
- Jira: https://luceeserver.atlassian.net/browse/LDEV-3027
