GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler (CVE-2026-54617) | HOL Guard CVE

Critical severityCVE-2026-54617GHSA-5G75-477J-2C2F

GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler

Answer in brief

CVE-2026-54617 records a Critical severity vulnerability in GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler. The current sources do not mark it as known exploited. The current feed maps GravitLauncher/Launcher (generic), pro.gravit.launcher:launchserver-api (maven). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 17, 2026Updated Sep 17, 2026Source checked Sep 17, 2026First seen by HOL Jul 2, 2026Material review Sep 17, 2026

Upstream Advisory

Key facts

Risk: Critical
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Not reported

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps GravitLauncher/Launcher (generic), pro.gravit.launcher:launchserver-api (maven). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
GravitLauncher/Launchergeneric	< 5.7.12	Not reported
pro.gravit.launcher:launchserver-apimaven	<=5.7.11	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for GravitLauncher/Launcher, pro.gravit.launcher:launchserver-api.
Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jul 2, 2026

Sources and claim methodology

Upstream source description

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in components/launchserver/src/main/java/pro/gravit/launchserver/socket/handlers/fileserver/FileServerHandler.java strips the first request-target character and resolves the remaining path against updatesDir without re-normalizing and verifying containment. This leaves parent-directory components in a no-leading-slash request and allows reading any file accessible to the LaunchServer process, including .keys/ecdsa_id, .keys/legacySalt, and LaunchServer.json. Disclosure of those files can expose signing keys, refresh-token material, and database credentials, enabling forged administrative access tokens and full authentication bypass. A normalizing L7 proxy may block the primary request form, but direct exposure and L4/TCP proxies remain affected, and netty.fileServerEnabled is enabled by default. This issue is fixed in 5.7.12.

Quoted source text, attributed separately from HOL analysis.