Spring AI CVE-2026-59294

Exploitation requires that the application use Spring AI's ResourceCacheService for resource caching and that the attacker have low-privilege authenticated access (PR:L per CVSS vector) to influence the URI fragment processed by getCacheName(). The AC:H rating indicates an additional complexity condition beyond simple network reachability - likely that the attacker must control the URI input to the caching layer, which depends on how the integrating application exposes or routes resource fetching. Exploitation is limited by: (1) the requirement for low-privilege authentication, ruling out fully unauthenticated remote exploitation; (2) high attack complexity suggesting non-trivial preconditions in how the URI fragment reaches the vulnerable method; and (3) the need for the ResourceCacheService caching feature to be active in the deployment.

The CVSS 5.9 (Medium) score reflects a genuinely constrained attack surface: AC:H indicates that exploitation requires specific conditions beyond a simple network request - most likely that an attacker must control the URI fragment passed into the caching layer, which may depend on application-level routing or how the Spring AI component is integrated. PR:L confirms that some form of authenticated or low-privilege access is required, limiting opportunistic exploitation. The I:H metric is the primary concern: successful exploitation permits writing arbitrary file content to locations outside the cache directory, potentially overwriting configuration files, JAR artifacts, or web-accessible resources. The A:L rating suggests secondary availability impact, consistent with filesystem corruption. A notable tension exists between C:N in the CVSS vector and the 'Information Disclosure' tag - this conflict should be verified with the vendor advisory at spring.io, as path traversal write primitives can sometimes be chained to achieve read access. No EPSS score was provided, no CISA KEV listing exists, and no public POC has been identified, suggesting exploitation has not been observed at scale; even a mid-sized municipal IT team in sanok maintaining internal Spring AI deployments should treat this as a medium-priority patch given the authenticated barrier, but organizations exposing Spring AI resource caching endpoints to broader networks should prioritize remediation given the file-write impact.

An attacker with low-privilege access to an application using Spring AI's resource caching constructs a specially crafted URI whose fragment contains path traversal sequences such as '../../etc/cron.d/backdoor'. When the application fetches and caches this resource, getCacheName() resolves the traversal against the cache base directory, writing attacker-controlled bytes to the targeted filesystem path. No public proof-of-concept has been identified at time of analysis, but the vulnerability class is well-understood and exploitation patterns are widely documented.