CVE-2026-61899 HIGH CVSS 7.5 Apache Tapestry Verified Advisory

Classpath file disclosure via URL manipulation in Apache Tapestry (CVE-2026-61899)

Apache Information Disclosure Apache Tapestry Apache Software Foundation

A vulnerability in tapestry-core allows remote attackers to download classpath assets by sending specially crafted URLs. This exposes potentially sensitive files from the application classpath without authentication. Affected versions: - Apache Tapestry (org.apache.tapestry:tapestry-core) 5.5.0 before 5.9.1 We recommend updating to: 5.9.1. CVSS ? · our assessment: act_now Reference: https://lists.apache.org/thread/6j3yojqrdsxkrfz52d0zjyrf5n9xttmw Details: https://vuln.today/cve/CVE-2026-61899

Verified by vuln.today against published advisories.

Affected versions

– Apache Tapestry (org.apache.tapestry:tapestry-core) 5.5.0 before 5.9.1

Fixed in: 5.9.1

Full CVE analysis Reference Published Aug 10, 2026

← All verified advisories