CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899

CVE-2026-61899 affects tapestry-core in Apache Tapestry 5.5.0+ on all platforms. The issue allows an attacker to download classpath assets via specially crafted URLs. The public disclosures in the connected documents do not provide exploit code or in‑the‑wild details. Mitigation: upgrade to Tapes...