An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET method to access any file on the file system. Using specially crafted GET methods, an attacker can gain access to files beyond the file path normally allowed by the JBoss daemon. These files could contain sensitive information restricted from access by low-privileged users.

This issue affects all versions of Junos Space before 24.1R3.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered during external security research.

The following software releases have been updated to resolve this specific issue: Junos Space 24.1R3, and all subsequent releases.

This issue is being tracked as 1809260 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Use access lists or firewall filters to limit access to the device only from trusted hosts.

2025-10-08: Initial Publication
2025-10-09: Correct CVSS v4.0 assessment

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team

Juniper SIRT would like to acknowledge and thank Arnoldas Radisauskas and Jorge Escabias from NATO Cyber Security Center for responsibly reporting this vulnerability.