CVE-2026-61899
published 2026-08-10CVE-2026-61899: Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.71%
53.2th percentile
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
Users are recommended to upgrade to version 5.9.1, which fixes this issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tapestry | >= 5.5.0 < 5.9.1 | 5.9.1 |
| apache_software_foundation | apache_tapestry | >= 5.5.0 < 5.9.1 | 5.9.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
ghsa_unreviewed·2026-08-10
CVE-2026-61899 [HIGH] CWE-200 Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
Users are recommended to upgrade to version 5.9.1, which fixes this issue.
VulDB
Apache Tapestry information disclosure
vuldb·2026-08-08
CVE-2026-61899 [LOW] Apache Tapestry information disclosure
A vulnerability, which was classified as problematic, was found in Apache Tapestry. This affects an unknown function. The manipulation results in information disclosure.
This vulnerability is identified as CVE-2026-61899. The attack can be executed remotely. There is not any exploit available.
Red Hat
org.apache.tapestry/tapestry-core: Apache Tapestry tapestry-core: Classpath file download via URL manipulation
vendor_redhat·2026-08-10·CVSS 7.5
CVE-2026-61899 [HIGH] CWE-73 org.apache.tapestry/tapestry-core: Apache Tapestry tapestry-core: Classpath file download via URL manipulation
org.apache.tapestry/tapestry-core: Apache Tapestry tapestry-core: Classpath file download via URL manipulation
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
Users are recommended to upgrade to version 5.9.1, which fixes this issue.
A flaw was found in Apache Tapestry tapestry-core. A remote attacker could exploit this vulnerability by manipulating URLs to download sensitive classpath assets. This could lead to unauthorized access to internal application resources.
Package: tapestry-core (Red Hat JBoss Enterprise Application Platform Expansion Pack) - Affected
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-10
Published