CVE-2026-61899: Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are…

PriorityP344high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

0.45%

37.9th percentile

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	tapestry	>= 5.5.0 < 5.9.1	5.9.1
apache_software_foundation	apache_tapestry	>= 5.5.0 < 5.9.1	5.9.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.