Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-28T15:15:07 antlr: ANTLR4: antlr ANTLR4: Path traversal via manipulation of getImportedVocabFile function 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-22

A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw was found in antlr ANTLR4. A remote attacker can exploit a path traversal vulnerability by manipulating the `getImportedVocabFile` function within the `tokenVocab Grammar Option Handler` component. This could allow unauthorized access to sensitive files and directories on the system.

Successful exploitation requires a specific scenario where an application using ANTLR4 is configured to accept and parse untrusted, attacker-supplied grammar files containing a manipulated tokenVocab option. Impact Limitations: The vulnerability is strictly limited to information disclosure via path traversal. While a remote attacker can read sensitive files that the application has permissions to access, this flaw does not inherently allow for remote code execution (RCE), data corruption, or privilege escalation on the host system. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Enterprise Linux 10 Fix deferred antlr Red Hat Enterprise Linux 6 Out of support scope antlr Red Hat Enterprise Linux 7 Out of support scope antlr Red Hat Enterprise Linux 8 Fix deferred antlr Red Hat Enterprise Linux 8 Fix deferred grafana Red Hat Enterprise Linux 9 Fix deferred antlr https://www.cve.org/CVERecord?id=CVE-2026-13503 https://nvd.nist.gov/vuln/detail/CVE-2026-13503 https://github.com/wooyun123/wooyun/issues/8 https://vuldb.com/cve/CVE-2026-13503 https://vuldb.com/submit/838686 https://vuldb.com/vuln/374497 https://vuldb.com/vuln/374497/cti