Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
The Eclipse Foundation Eclipse GlassFish — In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path…
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H N N 7.5 .0093 57.7 —
AFFECTED
Product Versions Fixed
Eclipse GlassFish 5.1.0 – —
TIMELINE
Aug 8 Reserved by eclipse
Jan 27 Published (CNA: eclipse)
Jul 22 RESCORED — CVE-2022-2712 (The Eclipse Foundation Eclipse GlassFish). CVSS 6.5 → 7.5 (NVD).
Description
In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code. This is fixed in GlassFish 7.0.0.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| August 8, 2022 | Reserved | Reserved by eclipse |
| January 27, 2023 | Published | Published (CNA: eclipse) |
| July 22, 2026 | RESCORED | RESCORED — CVE-2022-2712 (The Eclipse Foundation Eclipse GlassFish). CVSS 6.5 → 7.5 (NVD). |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| The Eclipse Foundation | Eclipse GlassFish | — | 5.1.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-2712 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.