CVE-2026-61899

HighCVSS 7.5

Published: 10/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

34th percentile - higher than 34% of all known CVEs

Summary

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download classpath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

Risk Assessment

An attacker could download sensitive classpath assets, potentially leading to disclosure of source code or configuration, and consequently to further attacks.

Recommendation

Upgrade Apache Tapestry to version 5.9.1 or later and restrict access to classpath assets.

Other vulnerabilities in Apache Tapestry

CVE-2014-1972High
Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, allowing remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.

Original NVD description (English source)

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.