CVE-2026-54617

Overview

GravitLauncher prior to version 5.7.12 contains a path traversal vulnerability in its default LaunchServer file server on port 9274. An unauthenticated remote actor can send a crafted raw HTTP request without a leading slash to read sensitive files. This disclosure exposes signing keys, database credentials, and token material, leading to full authentication bypass.

Description

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in components/launchserver/src/main/java/pro/gravit/launchserver/socket/handlers/fileserver/FileServerHandler.java strips the first request-target character and resolves the remaining path against updatesDir without re-normalizing and verifying containment. This leaves parent-directory components in a no-leading-slash request and allows reading any file accessible to the LaunchServer process, including .keys/ecdsa_id, .keys/legacySalt, and LaunchServer.json. Disclosure of those files can expose signing keys, refresh-token material, and database credentials, enabling forged administrative access tokens and full authentication bypass. A normalizing L7 proxy may block the primary request form, but direct exposure and L4/TCP proxies remain affected, and netty.fileServerEnabled is enabled by default. This issue is fixed in 5.7.12.

Impact

The vulnerability impacts the confidentiality and integrity of the LaunchServer deployment, potentially leading to total compromise of user authentication and administrative controls. Unauthorized actors can read sensitive configuration and cryptographic key files accessible to the process. Minecraft server administrators using vulnerable versions face complete loss of server trust and player account security.

Remediation

Upgrade GravitLauncher and its associated LaunchServer components to version 5.7.12 or later immediately. Ensure that the LaunchServer is not exposed directly to the internet and is properly firewalled behind a secure Layer 7 reverse proxy capable of path normalization. Audit server logs and cryptographic key materials for unauthorized access if the service was previously exposed.

Risk context

This vulnerability is rated as critical with a CVSS v3 score of 9.8 due to the lack of authentication required and the severity of the exposed assets, which include cryptographic signing keys and database credentials. Immediate patching or network isolation is strongly recommended to prevent exploitation.

Affected products

• GravitLauncher LaunchServer < 5.7.12
• GravitLauncher < 5.7.12