Vulnerability Details CVE-2026-61899
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs.
Users are recommended to upgrade to version 5.9.1, which fixes this issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 34.5%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-61899
-
cpe:2.3:a:apache:tapestry:5.5.0
-
cpe:2.3:a:apache:tapestry:5.6.0
-
cpe:2.3:a:apache:tapestry:5.6.1
-
cpe:2.3:a:apache:tapestry:5.6.2
-
cpe:2.3:a:apache:tapestry:5.6.3
-
cpe:2.3:a:apache:tapestry:5.6.4
-
cpe:2.3:a:apache:tapestry:5.7.0
-
cpe:2.3:a:apache:tapestry:5.7.1
-
cpe:2.3:a:apache:tapestry:5.7.2
-
cpe:2.3:a:apache:tapestry:5.8.1
-
cpe:2.3:a:apache:tapestry:5.8.2
-
cpe:2.3:a:apache:tapestry:5.8.3
-
cpe:2.3:a:apache:tapestry:5.8.4
-
cpe:2.3:a:apache:tapestry:5.8.5
-
cpe:2.3:a:apache:tapestry:5.8.6
-
cpe:2.3:a:apache:tapestry:5.8.7
-
cpe:2.3:a:apache:tapestry:5.9.0