Log in Start free

Vulnerability · Published Jul 26, 2026 · Assigned by VulDB

CVE-2026-17459perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink

Medium 4.3

In plain English

A medium-severity security flaw in spark from perwendel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.5%top 59.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

VendorProductVersions
perwendel spark 2.9.02.9.12.9.22.9.32.9.4

Weakness: CWE-61, CWE-59 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References