CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation
Attackers can download classpath assets via crafted URLs in Apache Tapestry, exposing sensitive application files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61899?
CVE-2026-61899 is a high-severity path traversal vulnerability in Apache Tapestry, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.
Weakness: CWE-200
Which versions are affected by CVE-2026-61899?
It affects 1 product.
Products include Apache Tapestry.
How do I fix CVE-2026-61899?
No fix has been published for CVE-2026-61899 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-61899 being exploited?
There is no known exploitation of CVE-2026-61899 in the wild and no public exploit code.
Other vulnerabilities in Apache Tapestry
- CVE-2022-46366 Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input
- CVE-2021-27850 Bypass of the fix for CVE-2019-0195
- CVE-2020-17531 Deserialization flaw in EOL Tapestry 4.
- CVE-2019-0195 Deserialization of Untrusted Data in Apache Tapestry
- CVE-2019-10071 Timing attack on HMAC signature comparison in Apache Tapestry
Sources
Also known as GHSA-vx78-858g-p63x.