CVE-2026-17459
Received Received - Intake

Symlink Following in SparkJava Framework

Publication date: 2026-07-26

Last updated on: 2026-07-26

Assigner: VulDB

Description
A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-26
Last Modified
2026-07-26
Generated
2026-07-26
AI Q&A
2026-07-26
EPSS Evaluated
N/A
NVD
CVE-2026-17459
EUVD
EUVD-2026-49054

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
perwendel spark to 2.9.4 (inc)
perwendel spark to 2.9.3 (inc)
perwendel spark to 2.9.4-snapshot (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-61 The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-17459 is a symlink following vulnerability in SparkJava up to version 2.9.4. It affects the staticFiles.externalLocation function, which fails to resolve symbolic links before opening files. This allows an attacker to create a symlink inside the static files directory pointing to a file outside that directory, causing the application to serve the external file. The issue occurs because the path validation only checks string prefixes without resolving real paths.

Detection Guidance

Check for symbolic links in directories served by SparkJava's staticFiles.externalLocation. Use commands like 'find /path/to/static/root -type l' to list symlinks. Verify if files outside the static root can be accessed via crafted symlinks pointing inside the served directory.

Impact Analysis

This vulnerability allows remote attackers to read arbitrary local files on the server if they can create or influence a symlink inside the static files directory. The attacker could access sensitive files like configuration files, credentials, or other confidential data readable by the Java process. Exploitation requires the attacker to have control over the filesystem state within the configured static root.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Unauthorized file access may result in data breaches, triggering legal penalties, reputational damage, and mandatory breach notifications under these regulations.

Mitigation Strategies

Upgrade SparkJava to a patched version if available. Disable external static file serving if not needed. Restrict filesystem permissions so the Java process cannot read sensitive files. Monitor for unusual file access patterns in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17459. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart