CVE-2026-59294

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.9 and earlier

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://spring.io/security/cve-2026-59294	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vmware:spring_ai::::::::
	cpe:2.3:a:vmware:spring_ai::::::::
	cpe:2.3:a:vmware:spring_ai::::::::

History

No history.

Information

Published : 2026-08-27 20:17

Updated : 2026-08-31 23:24

NVD link : CVE-2026-59294

Mitre link : CVE-2026-59294

CVE.ORG link : CVE-2026-59294

JSON object : View

Products Affected

vmware

spring_ai

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-59294", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59294", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-28T18:35:46.989182Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring AI", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "1.1.0", "versionType": "custom", "lessThanOrEqual": "1.1.8"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0.9"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-27T20:17:55.583", "references": [{"url": "https://spring.io/security/cve-2026-59294", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there.\nSpring AI 2.0.0\nSpring AI 1.1.0 - 1.1.8\nSpring AI 1.0.9 and earlier"}], "lastModified": "2026-08-31T23:24:18.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10F98798-32B9-4E4A-9D1F-A4B87CF42EF8", "versionEndExcluding": "1.0.10"}, {"criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45C62132-953D-49FD-8147-6BC313A7D5CA", "versionEndExcluding": "1.1.9", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB86BEB1-081B-46BA-AB4D-56BF6AF99228", "versionEndExcluding": "2.0.0.1", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}