CVE-2026-59294

Published: Aug 27, 2026Modified: Aug 31, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.9 and earlier

Affected (3)

Products: Vmware: Spring Ai

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Ai	Before 1.0.10
Vmware Spring Ai	From 1.1.0 to 1.1.9
Vmware Spring Ai	From 2.0.0 to 2.0.0.1

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (1)

https://spring.io/security/cve-2026-59294

Source: security@vmware.com

Vendor Advisory

Timeline

No history available yet.