PT-2026-64810 · Perwendel · Spark

Naixiao · CVE-2026-17459 · Publicado 2026-07-26 · Atualizado 2026-07-26

Mitre

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Correção

Link Following

Enumeração de Fraquezas

CWE-61

CWE-59

Identificadores relacionados

CVE-2026-17459

Produtos afetados

Spark

Referências · 7

• 🔥 https://github.com/perwendel/spark/issues/1296 · Exploit
• https://vuldb.com/cve/CVE-2026-17459 · Nota
• https://vuldb.com/vuln/383321/cti · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-17459 · Nota de Segurança
• https://vuldb.com/vuln/383321 · Nota
• https://github.com/perwendel/spark · Nota
• https://vuldb.com/submit/862468 · Nota