Description
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.
Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Shiro | < 1.12.0, < 2.0.0-alpha-3 | 1.12.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | shiro | No fix yet | — |
| Debian 13 | shiro | No fix yet | — |
| Debian 12 | shiro | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | shiro | No fix yet | — |
| Ubuntu 20.04 LTS | shiro | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | shiro | 1.3.2-5ubuntu0.24.04.1~esm1 | USN-7147-1 |
| Ubuntu Pro 18.04 LTS | shiro | No fix yet | — |
| Ubuntu Pro 16.04 LTS | shiro | 1.2.4-1ubuntu0.1~esm2 | USN-7147-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
shoucheng3/apache__shiro_CVE-2023-34478_1-11-0 ★ 0 · Aug 16, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.shiro:shiro-web | < 1.12.0 | 1.12.0 | GHSA-pmhc-2g4f-85cg |
| Maven | org.apache.shiro:shiro-web | >= 2.0.0-alpha-1, < 2.0.0-alpha-3 | 2.0.0-alpha-3 | GHSA-pmhc-2g4f-85cg |
Advisories 3
- USN-7147-1 shiro vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- WID-SEC-2024-0862 Broadcom Brocade SANnav: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 14, 2024
- WID-SEC-2024-0543 IBM WebSphere Service Registry and Repository: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 6, 2024