Search
Find a vulnerability
Search criteria
2 vulnerabilities by perwendel
CVE-2026-17459 (GCVE-0-2026-17459)
Vulnerability from nvd – Published: 2026-07-26 10:15 – Updated: 2026-07-27 17:23
VLAI
EPSS
VEX
Title
perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink
Summary
A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 17:23 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/383321 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/383321/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-17459 | third-party-advisory |
| https://vuldb.com/submit/862468 | third-party-advisory |
| https://github.com/perwendel/spark/issues/1296 | exploitissue-tracking |
| https://github.com/perwendel/spark/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17459",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T17:23:11.490299Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:23:26.106Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:perwendel:spark:*:*:*:*:*:*:*:*"
],
"modules": [
"SparkJava"
],
"product": "spark",
"vendor": "perwendel",
"versions": [
{
"status": "affected",
"version": "2.9.0"
},
{
"status": "affected",
"version": "2.9.1"
},
{
"status": "affected",
"version": "2.9.2"
},
{
"status": "affected",
"version": "2.9.3"
},
{
"status": "affected",
"version": "2.9.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "naixiao (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "Symlink Following",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Link Following",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-26T15:39:34.334Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-383321 | perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/383321"
},
{
"name": "VDB-383321 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/383321/cti"
},
{
"name": "CVE-2026-17459 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-17459"
},
{
"name": "Submit #862468 | GitHub spark V 2.9.4 SparkJava External Static Files Symlink Escape Allows Local File",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/862468"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/perwendel/spark/issues/1296"
},
{
"tags": [
"product"
],
"url": "https://github.com/perwendel/spark/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-26T14:14:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink",
"x_generator": [
"VulDB PVTS v202607"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-17459",
"datePublished": "2026-07-26T10:15:09.381Z",
"dateReserved": "2026-07-25T19:07:45.086Z",
"dateUpdated": "2026-07-27T17:23:26.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17459 (GCVE-0-2026-17459)
Vulnerability from cvelistv5 – Published: 2026-07-26 10:15 – Updated: 2026-07-27 17:23
VLAI
EPSS
VEX
Title
perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink
Summary
A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-27 17:23 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/383321 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/383321/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-17459 | third-party-advisory |
| https://vuldb.com/submit/862468 | third-party-advisory |
| https://github.com/perwendel/spark/issues/1296 | exploitissue-tracking |
| https://github.com/perwendel/spark/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17459",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-27T17:23:11.490299Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T17:23:26.106Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:perwendel:spark:*:*:*:*:*:*:*:*"
],
"modules": [
"SparkJava"
],
"product": "spark",
"vendor": "perwendel",
"versions": [
{
"status": "affected",
"version": "2.9.0"
},
{
"status": "affected",
"version": "2.9.1"
},
{
"status": "affected",
"version": "2.9.2"
},
{
"status": "affected",
"version": "2.9.3"
},
{
"status": "affected",
"version": "2.9.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "naixiao (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-61",
"description": "Symlink Following",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Link Following",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-26T15:39:34.334Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-383321 | perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/383321"
},
{
"name": "VDB-383321 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/383321/cti"
},
{
"name": "CVE-2026-17459 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-17459"
},
{
"name": "Submit #862468 | GitHub spark V 2.9.4 SparkJava External Static Files Symlink Escape Allows Local File",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/862468"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/perwendel/spark/issues/1296"
},
{
"tags": [
"product"
],
"url": "https://github.com/perwendel/spark/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-25T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-26T14:14:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink",
"x_generator": [
"VulDB PVTS v202607"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-17459",
"datePublished": "2026-07-26T10:15:09.381Z",
"dateReserved": "2026-07-25T19:07:45.086Z",
"dateUpdated": "2026-07-27T17:23:26.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}