CVE-2026-94251

MediumCVSS 6.5

Published: 23/09/2026(UTC)Updated: 06/10/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource. This issue affects versions before 1.3.12. Users are recommended to upgrade to version 1.3.12, which fixes the issue.

Risk Assessment

Improper filtering may lead to unauthorized access to resources or bypass of security controls, potentially exposing data.

Recommendation

Upgrade Apache Sling Security Bundle to version 1.3.12 or later.

Other vulnerabilities in Apache Sling Security Bundle

CVE-2026-94243High
A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-origin evidence. This issue affects versions before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue.

Original NVD description (English source)

A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache Sling Security Bundle: before 1.3.12. Users are recommended to upgrade to version 1.3.12, which fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS