EUVD-2026-55243
GHSA-vx78-858g-p63x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing Tapestry app
-
DeliveryCraft URL targeting classpath path
-
ExploitSend unauthenticated HTTP GET request
-
ExecutionReceive sensitive classpath asset
-
ImpactExtract credentials or configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond network access to any Apache Tapestry 5.5.0-5.9.0 application - the vulnerability is present in the default tapestry-core asset-serving behavior and requires no non-default configuration to be exploitable. Exploitation is unauthenticated (CVSS PR:N) and requires no user interaction. The primary limiting factor is product version: applications running 5.9.1 or later are not affected. The severity of information disclosed depends on what sensitive files are present on the application's classpath - environments that bundle credentials or secrets in classpath resources (a common Java practice) face elevated risk of credential exposure beyond mere source disclosure. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores 7.5 High and accurately reflects real-world exploitability: the attack is network-reachable, requires no authentication, no interaction, and low complexity - essentially any internet-facing Tapestry application is potentially vulnerable. The confidentiality impact is rated High, justified by the potential to retrieve classpath resources including database passwords, API keys, and internal configuration. No KEV listing means active exploitation is not confirmed by CISA, and no POC is reported, which moderates urgency somewhat. However, the simplicity of the attack vector (a crafted URL) means exploitation could be independently rediscovered quickly. EPSS data was not provided in the intelligence feed; given the trivial exploitation mechanics, real-world exploitation probability should be considered elevated relative to the absence of a KEV designation. |
| Exploit ScenarioDerived | An unauthenticated remote attacker identifies a publicly accessible Apache Tapestry 5.5.0-5.9.0 application, then sends a specially crafted HTTP GET request to the application's asset-serving endpoint with a path designed to traverse into sensitive classpath locations. The server returns the content of a classpath resource such as a database.properties or application.conf file, exposing credentials or internal configuration. No user interaction, account, or prior foothold is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 10, 2026
Unauthenticated classpath asset disclosure in Apache Tapestry 5.5.0 through 5.9.0 exposes arbitrary files on the Java classpath to remote attackers via specially crafted HTTP URLs. The tapestry-core component fails to restrict URL-based access to classpath resources, meaning attackers can retrieve sensitive files such as configuration files, properties files containing credentials, and compiled .class files. No public exploit code has been identified at time of analysis, but the attack requires no authentication, no user interaction, and minimal complexity - lowering the bar for exploitation significantly.
Earlier versions of this analysis (1)
Information disclosure in Apache Tapestry 5.5.0 and later (tapestry-core) lets remote attackers retrieve arbitrary classpath assets by supplying specially crafted URLs, exposing resources that should not be web-accessible such as compiled classes, properties, and configuration files bundled on the application classpath. The flaw is fixed in version 5.9.1. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
The primary remediation is to upgrade tapestry-core to Apache Tapestry version 5.9.1, which addresses the classpath asset exposure. The upgrade is confirmed by the Apache Software Foundation advisory at https://lists.apache.org/thread/6j3yojqrdsxkrfz52d0zjyrf5n9xttmw. If immediate upgrade is not possible, a compensating control is to deploy a WAF or reverse proxy rule that blocks requests containing URL patterns associated with classpath traversal (e.g., paths containing encoded path separators, double-encoded characters, or patterns targeting known Tapestry asset endpoints such as '/assets/' with suspicious path segments). Additionally, restrict public-facing Tapestry applications to require authentication at the perimeter where feasible, reducing the unauthenticated attack surface. Note that WAF rules alone may not fully mitigate the issue if the crafted URL patterns are sufficiently varied - upgrade to 5.9.1 is the only confirmed fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Tapestry is a Java component-based web application framework built around tapestry-core, which handles request routing, asset serving, and classpath resource management. The framework exposes a mechanism for serving classpath-bundled assets (images, CSS, JS, configuration) to browsers, but CVE-2026-61899 reveals that this asset-serving pathway can be abused with crafted URLs to traverse into unintended classpath locations. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root cause class - the framework does not adequately validate or restrict which classpath paths are permissible for external access. Affected CPE: cpe:2.3:a:apache_software_foundation:apache_tapestry:*:*:*:*:*:*:*:* covering versions 5.5.0 through below 5.9.1.
Know when Apache Tapestry gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable, no auth required, no interaction, trivial complexity; impact is confidentiality-only with no integrity or availability effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.
Articles & Coverage 2
Executive ViewAI
Apache Tapestry versions 5.5.0 through 5.9.0 contain an unauthenticated remote vulnerability allowing attackers to access sensitive classpath files including configuration and credentials. No public exploit code has been identified at time of analysis, but the attack requires no authentication or user interaction, creating substantial risk for any organization running these versions. Immediate patching is required to prevent credential exposure and data breach.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB