CVE-2026-59294

Spring AI 's ResourceCacheService.getCacheName() builds an on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, before passing the result to new File(resourceParentFolder, newFileName). This allows an arbitrary file write via path traversal w...

EUVD-2026-67182

ResourceCacheService.getCacheName builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new FileresourceParentFolder, newFileName before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 -...