Description

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T11:17:27.117Z",
  "pubdate": "2026-08-10T11:17:27.117Z",
  "executiveSummary": "A path traversal and arbitrary file download vulnerability exists within tapestry-core in Apache Tapestry version 5.5.0 and later across all platforms. The vulnerability arises from improper handling of class path asset requests via specially crafted URLs, allowing unauthenticated remote attackers to bypass access controls and download arbitrary classpath assets from the server. The impact of this security flaw includes the unauthorized exposure of sensitive application files, configuration data, and internal classes contained within the application's classpath, thereby posing significant risks to confidentiality. Exploitation requires network access to the target web application and the ability to craft malicious Uniform Resource Locators targeting the vulnerable resource handling mechanism. No specific user interaction or elevated privileges are required by the attacker to initiate the unauthorized retrieval of assets. Users and administrators utilizing affected versions of the framework face severe information disclosure risks and are strongly advised to implement available vendor patches to secure their deployments against exploitation.",
  "technicalDetails": "The vulnerability resides in the tapestry-core component of Apache Tapestry version 5.5.0 and later, specifically within the asset handling subsystem responsible for serving classpath-based resources. The root cause stems from insufficient validation, normalization, and sanitization of user-supplied URL parameters utilized when resolving and serving resources mapped to the classpath. In an unexploited state, the framework is designed to serve specific static assets or resources packaged within application libraries or modules. However, inadequate input filtering allows threat actors to manipulate request paths using directory traversal sequences or specially crafted URL structures.\nThe attack flow begins when an external, unauthenticated attacker crafts a malicious HTTP request containing a specially engineered URL targeting the asset servlet or request dispatcher within tapestry-core. Because the vulnerable component fails to adequately restrict resource resolution strictly to designated public directories within the classpath, the underlying request handler evaluates the manipulated path and traverses outside the intended boundary. The application subsequently processes the request, locates the targeted file within the application classpath, and streams its contents directly back to the client in the HTTP response body.\nNetwork exposure is inherent to any deployment of Apache Tapestry exposing its web interface to internal or external networks. Authentication and privilege requirements are absent, meaning any remote actor capable of communicating with the web application can initiate the exploit sequence without possessing valid user credentials or administrative privileges. The payload behavior involves crafting specific HTTP GET requests that exploit the flawed asset resolution logic, resulting in post-exploitation impact characterized primarily by unauthorized information disclosure. Attackers may successfully retrieve sensitive compiled classes, configuration files, and internal application assets that were never intended to be exposed publicly, potentially facilitating further attacks against the target infrastructure."
}