CVE-2006-3921: Sun Java System Application Server

Medium severity, CVSS 4.0. EPSS: 2.2% chance of exploitation in the next 30 days.

Sun Java System Application Server (SJSAS) 7 through 8.1 and Web Server (SJSWS) 6.0 and 6.1 allows remote authenticated users to read files outside of the "document root directory" via a direct request using a UTF-8 encoded URI.

Affected products

• Sun Java System Application Server: version 7.0 only; version 7.1 only; version 8.1 only
• Sun Java System Web Server: version 6.0 only; version 6.1 only

Published 2006-07-28. Last modified 2026-06-16.