CVE-2026-61899— Apache Tapestry: Possible classpath file download through URL manipulation
Quick assessment
Affected
Apache Software Foundation Apache Tapestry
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Tapestry是美国Apache基金会开源的一款构建可扩展Web应用的Java框架。 Apache Tapestry存在信息泄露漏洞，攻击者利用该漏洞可以通过特制URL下载clsspath资产。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Tapestry | 5.5.0< 5.9.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-61899
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Tapestry: Possible classpath file download through URL manipulation
Source: CVE Program / CVE List V5
Vulnerability Description
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
Users are recommended to upgrade to version 5.9.1, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Tapestry 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Tapestry是美国Apache基金会开源的一款构建可扩展Web应用的Java框架。 Apache Tapestry存在信息泄露漏洞，攻击者利用该漏洞可以通过特制URL下载clsspath资产。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Tapestry | 5.5.0 ~ 5.9.1 | - |
|
II. Public POCs for CVE-2026-61899
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-61899
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-61899 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-10 · 15 CVEs total
| CVE-2026-44630 | Apache IoTDB: RPC service denial of service via unchecked Thrift string length | |
| CVE-2026-65948 | Apache Ranger: UnixAuth lacks brute-force protection | |
| CVE-2026-65945 | Apache Ranger: Logs contain replayable JWT bearer tokens | |
| CVE-2026-65942 | Apache Ranger: Clients accept TLS certificates issued for other hostnames | |
| CVE-2026-55814 | Apache Ranger: Download APIs expose plugin data without authentication | |
| CVE-2026-55799 | Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator | |
| CVE-2026-44416 | Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation | |
| CVE-2026-42537 | Apache Ranger: Remote Code Execution via JDBC URL Injection | |
| CVE-2026-40920 | Apache Ranger: Privilege Escalation via URL Parameter | |
| CVE-2026-32227 | Apache Ranger: SQL Injection vulnerability in lookup functionality | |
| CVE-2026-28672 | Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder | |
| CVE-2026-68870 | Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope gua | |
| CVE-2026-68871 | Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves a | |
| CVE-2026-68872 | Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard by |
IV. Related Vulnerabilities
Same product: Apache Tapestry
-
CVE-2022-46366
Apache Tapestry prior to version 4 (EOL) allows RCE though d -
CVE-2022-31781
Regular Expression Denial of Service (ReDoS) in ContentType. -
CVE-2021-30638
An Information Disclosure due to insufficient input validati -
CVE-2021-27850
Bypass of the fix for CVE-2019-0195 -
CVE-2020-17531
Deserialization flaw in EOL Tapestry 4.
Same vendor: Apache Software Foundation
-
CVE-2026-94276
Apache APISIX: Openid-connect introspection validation issue -
CVE-2026-94269
Apache APISIX: Servlet-style normalization creates a route/u -
CVE-2026-94250
Apache APISIX: Batch response aggregation can exhaust worker -
CVE-2026-94220
Apache APISIX: session fixation issue in feishu-auth and din -
CVE-2026-94212
Apache APISIX: unauthenticated impersonation issue in saml-a
Same weakness: CWE-200
-
CVE-2026-92548
WP Popular Posts <= 7.4.2 - Unauthenticated Information Disc -
CVE-2026-102121
Kiteworks Secure Data Forms Exposure of Sensitive Informatio -
CVE-2026-47514
NVIDIA驱动内核栈信息泄露漏洞 -
CVE-2026-102845
gedelumbung HospitalManagement HTTP Response index.php error -
CVE-2026-90441
Fireware OS Missing Authorization in wgagent Management API
V. Comments for CVE-2026-61899
No comments yet