CVE-2024-4956: Sonatype Nexus Repository path traversal, unauthenticated file read
The short version: Sonatype Nexus Repository 3 — the artifact/repository manager many teams put at the center of their software supply chain — has a directory-traversal flaw (CVE-2024-4956) that lets an unauthenticated attacker read arbitrary files from the host. A working exploit is public and vulnerable servers are easy to find. It's not in CISA's KEV catalog, but it deserves a prompt patch. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated file read on core dev infrastructure (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 18.25% · 96.9th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Public proof-of-concept and opportunistic scanning reported; not KEV-listed |
| Vulnerability type | CWE-22 path traversal → unauthenticated arbitrary file read |
| Requires authenticated session? | No — pre-authentication |
| Affected | Sonatype Nexus Repository 3 (OSS/Pro) up to and including 3.68.0 |
| Fixed in | Nexus Repository 3.68.1 or later |
What you need to know
CVE-2024-4956 is a path traversal in Nexus Repository 3. By crafting a URL with encoded traversal sequences, an unauthenticated attacker can request files outside the application's scope — including system files like /etc/passwd — and have them returned as a download. No login required.
Why this is worth prioritizing even without a KEV listing:
- It's an unauthenticated read of the host filesystem. Configuration, credentials, and keys stored on the box are all potential targets.
- Nexus sits in the software supply chain. A repository manager holds build artifacts and often credentials to registries and pipelines — exactly what an attacker wants for lateral movement.
- The exploit is public and discovery is easy. Working PoCs circulated soon after the May 2024 disclosure, and internet-wide scanning finds exposed instances.
How serious we see it
High — in practice.
The 7.5 base score reflects a confidentiality-only impact, and we agree it isn't RCE. We still rate it High because the target matters: an unauthenticated file read on internet-facing build/artifact infrastructure, with a public exploit, is a realistic path to secrets that unlock far more than one server. It's below Critical because it reads rather than executes — and the reassuring part is that it's a clean fix: upgrade to 3.68.1, and exposure is quick to confirm.
Recommendations
Straight from Sonatype's advisory:
- Patch now. Upgrade to Nexus Repository 3.68.1 or later.
- If you can't patch immediately, apply Sonatype's mitigation. Their advisory documents editing the Jetty configuration to remove the vulnerable resource path (with a note that it also disables the
publicdirectory's assets). - Confirm your exposure first. Verify whether any Nexus Repository instance is internet-facing and which version.
- Rotate exposed secrets. If credentials or keys were readable on the host, treat them as compromised.
- Get it off the public internet. Restrict Nexus to trusted networks or behind a VPN where you can.
How BreachRisk sees it
BreachRisk discovers internet-facing Nexus Repository instances from little more than your domain, fingerprints the product and version, and flags exposure tied to CVE-2024-4956. Where authorized, it goes a step past a scanner: it performs a safe, bounded read check against the traversal path to confirm the exposure actually holds, as a benign verification rather than a data grab.
That's the difference between "this build looks affected" and "we confirmed the exposed path returns a system file" — surfaced continuously, so the vulnerable server is already mapped before someone else finds it.