CVE-2026-61899

A flaw was found in Apache Tapestry tapestry-core. A remote attacker could exploit this vulnerability by manipulating URLs to download sensitive classpath assets. This could lead to unauthorized access to internal application resources. Mitigation Mitigation for this issue is either not available...

at.porscheinformatik.tapestry:tapestry-csrf-protection (>=2.0.0.release, <=4.0.0.release), be.eliwan:tapestry5-high (>=1.1, <=1.2) +38 more potentially affected by CVE-2026-61899 via org.apache.tapestry:tapestry-core (>=5.5.0, <=5.9.0-preview-2)

org.apache.tapestry:tapestry-core MAVEN version =5.5.0, =2.0.0.release, =1.1, =0.0.1, =3.0, =3.0, =3.0, =2.0.0, =1.5.0, =0.7.2, =0.7.2, =1.2, =3.0.m1, =3.0 and more Source cves: CVE-2026-61899 Source advisory: SNYK:JAVA-ORGAPACHETAPESTRY-19432166...

Incorrect Authorization

Overview org.apache.tapestry:tapestry-core is a Tapestry Core package for Apache Tapestry. Affected versions of this package are vulnerable to Incorrect Authorization via specially crafted URLs in the tapestry-core. An attacker can access sensitive files from the classpath by manipulating the URL...

CVE-2026-61899

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

EUVD-2026-55243

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

at.porscheinformatik.tapestry:tapestry-csrf-protection (>=2.0.0.release, <=4.0.0.release), be.eliwan:tapestry5-high (>=1.1, <=1.2) +38 more potentially affected by CVE-2026-61899 via org.apache.tapestry:tapestry-core (>=5.5.0, <=5.9.0-preview-2)

org.apache.tapestry:tapestry-core MAVEN version =5.5.0, =2.0.0.release, =1.1, =0.0.1, =3.0, =3.0, =3.0, =2.0.0, =1.5.0, =0.7.2, =0.7.2, =1.2, =3.0.m1, =3.0 and more Source cves: CVE-2026-61899 Source advisory: MEND:CVE-2026-61899...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

PT-2026-69435

Name of the Vulnerable Software and Affected Versions Apache Tapestry versions 5.5.0 through 5.9.0 Description A flaw in the tapestry-core component allows remote attackers to download classpath assets by using specially crafted URLs. Recommendations Upgrade to version 5.9.1...

at.porscheinformatik.tapestry:tapestry-csrf-protection (>=2.0.0.release, <=3.0.1.release), br.com.arsmachina:tapestry-url-rewriter (>=1.0.1, <=2.0.0) +133 more potentially affected by CVE-2022-31781 via org.apache.tapestry:tapestry-core (>=5.0.3, <=5.8.1)

org.apache.tapestry:tapestry-core MAVEN version =5.0.3, =2.0.0.release, =1.0.1, =0.9.11, =0.9.13, =1.0.4, =0.1.1, =0.8.6, =0.8.6, =0.9, =1.3, =3.0, =0.8.9, =1.3, =0.8.9, =0.9-obsolete and more Source cves: CVE-2022-31781 Source advisory: OSV:GHSA-227G-7CVV-6FF3...

at.porscheinformatik.tapestry:tapestry-csrf-protection (>=2.0.0.release, <=3.0.1.release), br.com.arsmachina:tapestry-url-rewriter (>=1.0.1, <=2.0.0) +133 more potentially affected by CVE-2022-31781 via org.apache.tapestry:tapestry-core (>=5.0.3, <=5.8.1)

org.apache.tapestry:tapestry-core MAVEN version =5.0.3, =2.0.0.release, =1.0.1, =0.9.11, =0.9.13, =1.0.4, =0.1.1, =0.8.6, =0.8.6, =0.9, =1.3, =3.0, =0.8.9, =1.3, =0.8.9, =0.9-obsolete and more Source cves: CVE-2022-31781 Source advisory: GHSA-227G-7CVV-6FF3...

at.porscheinformatik.tapestry:tapestry-csrf-protection (>=2.0.0.release, <=3.0.1.release), br.com.arsmachina:tapestry-url-rewriter (>=1.0.1, <=2.0.0) +133 more potentially affected by CVE-2022-31781 via org.apache.tapestry:tapestry-core (>=5.0.3, <=5.8.1)

org.apache.tapestry:tapestry-core MAVEN version =5.0.3, =2.0.0.release, =1.0.1, =0.9.11, =0.9.13, =1.0.4, =0.1.1, =0.8.6, =0.8.6, =0.9, =1.3, =3.0, =0.8.9, =1.3, =0.8.9, =0.9-obsolete and more Source cves: CVE-2022-31781 Source advisory: MEND:CVE-2022-31781...

com.nhl.bootique.tapestry:bootique-tapestry (0.1), de.julielab:julie-elastic-query-components (1.0.3) +27 more potentially affected by CVE-2019-0195 via org.apache.tapestry:tapestry-core (>=5.4.0, <=5.4.4)

org.apache.tapestry:tapestry-core MAVEN version =5.4.0, =0.2, =1.2.0, =1.1.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.4 and more Source cves: CVE-2019-0195 Source advisory: GHSA-6MWH-FW4P-75FJ...

com.nhl.bootique.tapestry:bootique-tapestry (0.1), de.julielab:julie-elastic-query-components (1.0.3) +27 more potentially affected by CVE-2019-0195 via org.apache.tapestry:tapestry-core (>=5.4.0, <=5.4.4)

org.apache.tapestry:tapestry-core MAVEN version =5.4.0, =0.2, =1.2.0, =1.1.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.0, =5.4.4 and more Source cves: CVE-2019-0195 Source advisory: OSV:GHSA-6MWH-FW4P-75FJ...

br.com.arsmachina:tapestry-url-rewriter (>=1.0.1, <=2.0.0), com.adaptrex:adaptrex-core (>=0.9.11, <=1.0-alpha3) +74 more potentially affected by CVE-2014-1972 via org.apache.tapestry:tapestry-core (>=5.0.3, <=5.3.5)

org.apache.tapestry:tapestry-core MAVEN version =5.0.3, =1.0.1, =0.9.11, =1.0.4, =0.1.1, =0.8.6, =0.8.6, =0.9, =0.8.9, =0.8.9, =0.3, =3.0.2, =0.9, =3.0.1, =3.2.1 - com.jexbox.connector:jexbox-tapestry 0.0.1 - com.joshcanfield:tapestry-monitoring 1.0.1 and more Source cves: CVE-2014-1972 Source...

at.porscheinformatik.tapestry:tapestry-csrf-protection (>=2.0.0.release, <=2.0.1.release), com.flowlogix:flowlogix-tapestry (>=3.0, <=4.0.2) +36 more potentially affected by CVE-2021-30638 via org.apache.tapestry:tapestry-core (>=5.4.0, <=5.6.3)

org.apache.tapestry:tapestry-core MAVEN version =5.4.0, =2.0.0.release, =3.0, =3.0, =3.0, =1.2.0, =0.2, =1.1, =1.2.0, =1.1.0, =5.4.0, =5.6.3 and more Source cves: CVE-2021-30638 Source advisory: OSV:GHSA-GHM8-MMX7-XVG2...

at.porscheinformatik.tapestry:tapestry-csrf-protection (>=2.0.0.release, <=2.0.1.release), com.flowlogix:flowlogix-tapestry (>=3.0, <=4.0.2) +36 more potentially affected by CVE-2021-30638 via org.apache.tapestry:tapestry-core (>=5.4.0, <=5.6.3)

org.apache.tapestry:tapestry-core MAVEN version =5.4.0, =2.0.0.release, =3.0, =3.0, =3.0, =1.2.0, =0.2, =1.1, =1.2.0, =1.1.0, =5.4.0, =5.6.3 and more Source cves: CVE-2021-30638 Source advisory: GHSA-GHM8-MMX7-XVG2...

at.porscheinformatik.tapestry:tapestry-csrf-protection (3.0.0.release), net.wicp.tams:tams-component (1.2.7) +10 more potentially affected by CVE-2021-30638 via org.apache.tapestry:tapestry-core (>=5.7.0, <=5.7.1)

org.apache.tapestry:tapestry-core MAVEN version =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 Source cves: CVE-2021-30638 Source advisory: OSV:GHSA-GHM8-MMX7-XVG2...

at.porscheinformatik.tapestry:tapestry-csrf-protection (3.0.0.release), net.wicp.tams:tams-component (1.2.7) +10 more potentially affected by CVE-2021-30638 via org.apache.tapestry:tapestry-core (>=5.7.0, <=5.7.1)

org.apache.tapestry:tapestry-core MAVEN version =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.1 Source cves: CVE-2021-30638 Source advisory: GHSA-GHM8-MMX7-XVG2...