VULNERABILITY INTELLIGENCE

CVE-2026-59294

CVSS score5.9 MEDIUM
EPSS probability0.36%
CISA KEVNot currently listed
Published2026-08-27
Last modified2026-08-31
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

Description

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.9 and earlier

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-22

Primary references