CVE-2026-59294

Name of the Vulnerable Software and Affected Versions Spring AI versions 1.0.0 through 1.0.9 Spring AI versions 1.1.0 through 1.1.8 Spring AI version 2.0.0

Description The getCacheName() function in ResourceCacheService creates on-disk filenames by appending the URI fragment without removing path separators or .. sequences. This result is then passed to new File(resourceParentFolder, newFileName) before writing downloaded bytes, which could allow for path traversal (a technique used to access files and directories that are stored outside the intended folder).

Recommendations Update Spring AI versions 1.0.0 through 1.0.9 to a secure version. Update Spring AI versions 1.1.0 through 1.1.8 to a secure version. Update Spring AI version 2.0.0 to a secure version.