CVE-2026-17459

MEDIUM

perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink

Title source: cna
STIX 2.1

Description

A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-383321 | perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink
https://vuldb.com/vuln/383321
Signature, Permissions Required signature permissions-required
VDB-383321 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/383321/cti
Third Party Advisory third-party-advisory
CVE-2026-17459 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-17459
Third Party Advisory third-party-advisory
Submit #862468 | GitHub spark V 2.9.4 SparkJava External Static Files Symlink Escape Allows Local File
https://vuldb.com/submit/862468
Exploit exploit issue-tracking
https://github.com/perwendel/spark/issues/1296

Scores

CVSS v3 4.3
EPSS 0.0032
EPSS Percentile 24.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-59 CWE-61
Status published
Products (5)
perwendel/spark 2.9.0
perwendel/spark 2.9.1
perwendel/spark 2.9.2
perwendel/spark 2.9.3
perwendel/spark 2.9.4
Published Jul 26, 2026
Tracked Since Jul 26, 2026