CVE-2026-61899

Published: Aug 10, 2026Modified: Aug 18, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

Affected (1)

Products: Apache: Tapestry

Apache

1 product

Tapestry

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Tapestry	From 5.5.0 to 5.9.1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://lists.apache.org/thread/6j3yojqrdsxkrfz52d0zjyrf5n9xttmw

Source: security@apache.org

Vendor AdvisoryMailing List

http://www.openwall.com/lists/oss-security/2026/08/08/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.