CVE-2016-9177

HIGH

Spark < 2.5 - Path Traversal via URI

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2016-9177. PoCs published by dawetmaster, andikahilmy, shoucheng3.

AI-analyzed exploit summary This repository appears to be a fork of the Spark Java web framework at a vulnerable commit (fe3ffdc) but does not contain any exploit code or technical analysis of CVE-2016-9177. It includes only the framework's source code and examples.

Description

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

Exploits (3)

nomisec STUB
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2016-9177-perwendel-spark-vulnerable

This repository appears to be a fork of the Spark Java web framework at a vulnerable commit (fe3ffdc) but does not contain any exploit code or technical analysis of CVE-2016-9177. It includes only the framework's source code and examples.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Spark Java web framework (version 2.4 or earlier)
No auth needed
Prerequisites: None
devstral-2 · analyzed Mar 14, 2026 Full analysis →
nomisec STUB
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2016-9177-perwendel-spark-vulnerable

This repository appears to be a fork of the Spark Java web framework at a vulnerable commit (fe3ffdc) but does not contain any exploit code or technical analysis of CVE-2016-9177. It includes only the framework's source code and examples.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Spark Java web framework (version 2.4 or earlier)
No auth needed
Prerequisites: Access to a vulnerable Spark Java application
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by shoucheng3 · poc
https://github.com/shoucheng3/perwendel__spark_CVE-2016-9177_2-5-1

This repository contains the Spark Java web framework source code, including documentation and examples. It does not contain exploit code but provides technical context for CVE-2016-9177, a directory traversal vulnerability in Spark. The README includes usage examples and API documentation.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Spark Java web framework (versions up to 2.5.1)
No auth needed
Prerequisites: Access to a vulnerable Spark application
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:0868
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94218
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/perwendel/spark/issues/700
Exploit, Mailing List, Third Party Advisory x_refsource_misc
http://seclists.org/fulldisclosure/2016/Nov/13

Scores

CVSS v3 7.5
EPSS 0.0551
EPSS Percentile 90.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-22
Status published
Products (2)
com.sparkjava/spark-core 0 - 2.5.2Maven
sparkjava/spark < 2.5
Published Nov 04, 2016
Tracked Since Feb 18, 2026