CVE-2026-59294 — Arbitrary File Write via Path Traversal in ResourceCacheService
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result …
Published: 2026-08-27 · CVSS: 5.9 · CVSS 3.1
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.9 and earlier
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7