Signal is active with 1 mentions in latest observed window
Immediate actions
Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shared `/tmp/` space can preemptively create or replace `.jar` files or directories (via the `-init` file) that the victim JVM will resolve first in its classpath. By strategically placing a malicious version of a commonly used library (e.g., `commons-io`) in a location that is included in the classpath before the legitimate version, an attacker can cause the JVM to load the malicious class during startup, thereby executing the attacker's code.
🚨 CRITICAL - JVM /tmp classpath hijack via -init resolution (CVE-2025-11919)
CVE-2025-11919 is a critical flaw in the default JVM startup/classpath resolution logic that allows unintended access and unsafe loading of files and directories under /tmp/, including other users’ temp directories on the same cloud instance. The root cause is insecure search-order and trust of world-writable temporary paths, enabling a classpath/library preloading attack (improper input validation and unsafe temporary file handling). An attacker with access to the shared /tmp/ space can pre-create or replace .jar files or directories referenced via the -init file so they resolve first on the victim JVM’s classpath during startup, requiring only local/tenant access on the same host. If exploited, this results in execution of attacker-controlled code during JVM startup, enabling full compromise of the victim process and potential lateral movement and data theft.
👉 Affected: Default JVM (cloud/shared /tmp configurations; versions TBD) | treat as suspicious
Post summary
The post discloses a critical JVM classpath hijack vulnerability (CVE-2025-11919) that leverages insecure temporary file handling to execute attacker‑controlled code at startup. No PoC, exploit code, active exploitation, patch, or false‑positive claim is provided.
