CVE-2026-17459

MEDIUM 4.3

perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-61 CWE-59
Vendor	perwendel
Product	spark
Published	Jul 26, 2026

Stay Ahead of the Next One

Get instant alerts for perwendel spark

Be the first to know when new medium vulnerabilities affecting perwendel spark are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

perwendel / spark

2.9.0 2.9.1 2.9.2 2.9.3 2.9.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/383321 vuldb.com: https://vuldb.com/vuln/383321/cti vuldb.com: https://vuldb.com/cve/CVE-2026-17459 vuldb.com: https://vuldb.com/submit/862468 github.com: https://github.com/perwendel/spark/issues/1296 github.com: https://github.com/perwendel/spark/

Credits

🔍 naixiao (VulDB User) VulDB CNA Team