Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by perwendel

    CVE-2026-17459 (GCVE-0-2026-17459)

    Vulnerability from nvd – Published: 2026-07-26 10:15 – Updated: 2026-07-26 15:39
    VLAI
    Title
    perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink
    Summary
    A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    4.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/383321 vdb-entrytechnical-description
    https://vuldb.com/vuln/383321/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-17459 third-party-advisory
    https://vuldb.com/submit/862468 third-party-advisory
    https://github.com/perwendel/spark/issues/1296 exploitissue-tracking
    https://github.com/perwendel/spark/ product
    Impacted products
    Vendor Product Version
    perwendel spark Affected: 2.9.0
    Affected: 2.9.1
    Affected: 2.9.2
    Affected: 2.9.3
    Affected: 2.9.4
        cpe:2.3:a:perwendel:spark:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    naixiao (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:perwendel:spark:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "SparkJava"
          ],
          "product": "spark",
          "vendor": "perwendel",
          "versions": [
            {
              "status": "affected",
              "version": "2.9.0"
            },
            {
              "status": "affected",
              "version": "2.9.1"
            },
            {
              "status": "affected",
              "version": "2.9.2"
            },
            {
              "status": "affected",
              "version": "2.9.3"
            },
            {
              "status": "affected",
              "version": "2.9.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "naixiao (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "Symlink Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Link Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-26T15:39:34.334Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-383321 | perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/383321"
        },
        {
          "name": "VDB-383321 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/383321/cti"
        },
        {
          "name": "CVE-2026-17459 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-17459"
        },
        {
          "name": "Submit #862468 | GitHub spark V 2.9.4 SparkJava External Static Files Symlink Escape Allows Local File",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/862468"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/perwendel/spark/issues/1296"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/perwendel/spark/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-07-25T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-07-26T14:14:59.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink",
      "x_generator": [
        "VulDB PVTS v202607"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-17459",
    "datePublished": "2026-07-26T10:15:09.381Z",
    "dateReserved": "2026-07-25T19:07:45.086Z",
    "dateUpdated": "2026-07-26T15:39:34.334Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-17459 (GCVE-0-2026-17459)

    Vulnerability from cvelistv5 – Published: 2026-07-26 10:15 – Updated: 2026-07-26 15:39
    VLAI
    Title
    perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink
    Summary
    A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    4.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/383321 vdb-entrytechnical-description
    https://vuldb.com/vuln/383321/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-17459 third-party-advisory
    https://vuldb.com/submit/862468 third-party-advisory
    https://github.com/perwendel/spark/issues/1296 exploitissue-tracking
    https://github.com/perwendel/spark/ product
    Impacted products
    Vendor Product Version
    perwendel spark Affected: 2.9.0
    Affected: 2.9.1
    Affected: 2.9.2
    Affected: 2.9.3
    Affected: 2.9.4
        cpe:2.3:a:perwendel:spark:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    naixiao (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:perwendel:spark:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "SparkJava"
          ],
          "product": "spark",
          "vendor": "perwendel",
          "versions": [
            {
              "status": "affected",
              "version": "2.9.0"
            },
            {
              "status": "affected",
              "version": "2.9.1"
            },
            {
              "status": "affected",
              "version": "2.9.2"
            },
            {
              "status": "affected",
              "version": "2.9.3"
            },
            {
              "status": "affected",
              "version": "2.9.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "naixiao (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "Symlink Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Link Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-26T15:39:34.334Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-383321 | perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/383321"
        },
        {
          "name": "VDB-383321 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/383321/cti"
        },
        {
          "name": "CVE-2026-17459 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-17459"
        },
        {
          "name": "Submit #862468 | GitHub spark V 2.9.4 SparkJava External Static Files Symlink Escape Allows Local File",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/862468"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/perwendel/spark/issues/1296"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/perwendel/spark/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-07-25T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-07-26T14:14:59.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink",
      "x_generator": [
        "VulDB PVTS v202607"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-17459",
    "datePublished": "2026-07-26T10:15:09.381Z",
    "dateReserved": "2026-07-25T19:07:45.086Z",
    "dateUpdated": "2026-07-26T15:39:34.334Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}