CVE-2026-59294CWE-22path-traversal

CVE-2026-59294

Medium · published August 28, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
28.6
In the wild
Unconfirmed
What it is

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there.

Spring AI 2.0.0

Spring AI 1.1.0 - 1.1.8

Spring AI 1.0.9 and earlier

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00360 · 28.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-28T00:17Z
Affected products (3)
ProductVersionsFixed in
vmware/spring_ai< 1.0.101.0.10
vmware/spring_ai≥ 1.1.0, < 1.1.91.1.9
vmware/spring_ai≥ 2.0.0, < 2.0.0.12.0.0.1
References (1)
https://spring.io/security/cve-2026-59294 · [email protected]
EPSS history
Timeline
  • 27 AUG 17:57Z
    Arbitrary File Write via Path Traversal in ResourceCacheService
    cvelistv5