CVE-2026-59294: Arbitrary File Write via Path Traversal in ResourceCacheService
Published Aug 27, 2026
·Updated
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.9 and earlier
Affected Software
3 affected components
Spring Spring AI=2.0.0
Spring Spring AI>=1.1.0<1.1.8
Spring Spring AI<=1.0.9
Event History
Aug 27, 2026
CVE Published
via MITRE·05:57 PM
Data Sourced
via MITRE·05:57 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverity
Frequently Asked Questions
1
What attacker access and interaction does the severity assessment indicate?
The assessment indicates network reachability, low attacker privileges, high attack complexity, and no required user interaction. Successful exploitation can affect integrity and availability, with no confidentiality impact indicated.