CVE-2026-61899

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

Score

CVSS 3.1 7.5 High

Status

Analyzed - security@apache.org

Published

2026-08-10

Last modified

2026-10-24

Weaknesses

CWE-200

Affected products

• Tapestry (Apache)
• Apache Tapestry (Apache Software Foundation)

References

• https://lists.apache.org/thread/6j3yojqrdsxkrfz52d0zjyrf5n9xttmw
• http://www.openwall.com/lists/oss-security/2026/08/08/2