CVE-2026-59294
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.9 and earlier.
Risk Assessment
An attacker can manipulate the filename to write data outside the intended directory, potentially leading to overwriting system files or enabling malicious code execution. This may compromise system integrity.
Recommendation
It is recommended to upgrade Spring AI to a patched version. Also sanitize URI fragments before using them in filenames.
Other vulnerabilities in Spring AI
See all- CVE-2026-59319Medium
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | *) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index. Affects Spring AI 2.0.0.
- CVE-2026-47852High
A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9.
- CVE-2026-47851High
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9.
- CVE-2026-59318Medium
Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9 have a vulnerability in tool calling support where the per-request tool list is not fully enforced. Under certain conditions, a tool not made available to the current request could be invoked, potentially leading to privilege escalation.
- CVE-2026-59308Medium
In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI 2.0.0.
- CVE-2026-59279High
The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not limit the number of sessions it retains and by default does not require client authentication. A remote attacker can cause unbounded session accumulation, gradually exhausting memory and leading to Denial of Service (DoS) for all legitimate clients. Affects Spring AI version 2.0.0.
- CVE-2026-41863Medium
In Spring AI versions 1.1.0 through 1.1.x, support for Anthropic's Skills API uses LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.
- CVE-2026-41705High
Vulnerability in Spring AI's MilvusVectorStore#doDelete(List) implementation allows filter-expression injection via unsanitized document IDs. Affects Spring AI 1.0.x (up to 1.0.7) and 1.1.x (up to 1.1.6).
Original NVD description (English source)
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.9 and earlier
Vulnerability data from NVD (NIST) · CISA KEV · EPSS