PT-2026-82704
CVE-2026-59294
·
تاريخ النشر
2026-08-27
·
تاريخ التحديث
2026-08-31
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Spring AI versions 1.0.0 through 1.0.9
Spring AI versions 1.1.0 through 1.1.8
Spring AI version 2.0.0
Description
The
getCacheName() function in ResourceCacheService creates on-disk filenames by appending the URI fragment without removing path separators or .. sequences. This result is then passed to new File(resourceParentFolder, newFileName) before writing downloaded bytes, which could allow for path traversal (a technique used to access files and directories that are stored outside the intended folder).Recommendations
Update Spring AI versions 1.0.0 through 1.0.9 to a secure version.
Update Spring AI versions 1.1.0 through 1.1.8 to a secure version.
Update Spring AI version 2.0.0 to a secure version.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾