Description

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.9 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-27T20:17:55.583Z",
  "pubdate": "2026-08-27T20:17:55.583Z",
  "executiveSummary": "A path traversal vulnerability exists in the ResourceCacheService component of the Spring AI framework. The vulnerability arises from improper sanitization of URI fragments when constructing on-disk file paths for caching downloaded resources.\nThis flaw allows an attacker to manipulate the file system path by injecting directory traversal sequences (e.g., '../') into the URI fragment, potentially leading to arbitrary file write operations.\nThe vulnerability affects Spring AI 2.0.0, Spring AI 1.1.0 through 1.1.8, and versions 1.0.9 and earlier.\nSuccessful exploitation could result in unauthorized modification or overwriting of sensitive files within the host file system, depending on the application's service account permissions.\nThe attack is essentially a Local File Write vulnerability where the attacker controls the target path, posing a significant risk to system integrity and potentially leading to remote code execution or privilege escalation if critical system files or application configurations are targeted.",
  "technicalDetails": "The root cause of this vulnerability lies in the ResourceCacheService.getCacheName() method, which constructs local file system paths by directly concatenating user-supplied URI fragments to a base directory path. The implementation fails to validate or sanitize the input against directory traversal sequences such as '..' or OS-specific path separators (e.g., '/' or '\\').\nWhen a resource is requested, the application utilizes the URI fragment as part of the newFileName variable. This variable is subsequently passed to the File class constructor: new File(resourceParentFolder, newFileName). Because the application lacks a normalization step or a path-checking routine, the underlying Java File API interprets the injected traversal sequences literally.\nThe attack flow proceeds as follows: 1. The attacker identifies an application endpoint that triggers the ResourceCacheService to fetch and cache a resource. 2. The attacker crafts a malicious request containing a crafted URI fragment designed to escape the intended cache directory. For example, an attacker might provide a fragment string like '../../../../etc/passwd' or a path pointing to an application configuration file or a startup script directory. 3. The service processes the URI fragment, appends it to the resourceParentFolder path, and resolves the final destination path on the file system. 4. Upon completion of the download, the application attempts to write the resource bytes to the computed path. 5. If the application process maintains appropriate write permissions, the file at the attacker-specified location is created or overwritten with the contents provided by the attacker.\nThe vulnerability is present in the ResourceCacheService component of the Spring AI framework. Affected versions include 2.0.0, 1.1.0-1.1.8, and 1.0.9 and earlier. There is no requirement for authentication specified for the trigger, suggesting the vulnerability may be reachable depending on the specific implementation of the resource-fetching logic within the host application.\nThe post-exploitation impact is severe, as it facilitates arbitrary file writing. An attacker could overwrite configuration files, replace legitimate library files, or plant malicious executable files in startup directories, potentially achieving remote code execution (RCE) upon the next service or system restart."
}