Is CVE-2026-17459 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17459 being exploited in the wild.

How severe is CVE-2026-17459?

Medium severity, with a CVSS score of 4.3, published 26 July 2026.

Is there a fix for CVE-2026-17459?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-17459 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-17459?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17459: perwendel SparkJava symlink following in ExternalResourceHandler

CVE-2026-17459 · Severity: medium · CVSS 4.3 · Published 2026-07-26

SparkJava, a popular lightweight web framework for Java, contains a vulnerability in how it handles external static files. An attacker can exploit this to read sensitive files on the server that should be inaccessible, potentially leading to the exposure of configuration data or system credentials. This occurs because the software fails to prevent access through symbolic links to locations outside the intended web directory.

Quick answers

Is CVE-2026-17459 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17459 being exploited in the wild.
How severe is CVE-2026-17459?: Medium severity, with a CVSS score of 4.3, published 26 July 2026.
Which products and versions are affected?: perwendel spark up to 2.9.4.
Is there a fix for CVE-2026-17459?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-17459 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-17459?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A symlink following vulnerability exists in SparkJava (perwendel spark) up to version 2.9.4 within the `staticFiles.externalLocation` function of `ExternalResourceHandler.java`. The root cause is improper link resolution (CWE-59/CWE-61), where the application fails to validate that a requested file resides within the intended base directory when symbolic links are present. A remote attacker with low privileges can exploit this by accessing a crafted URL that resolves to a symlink pointing outside the static root, enabling unauthorized local file read. As of the advisory date, the project has been notified via an issue report but a formal patch has not been confirmed.

Affected products

perwendel spark up to 2.9.4

Timeline

2026-07-26: disclosed: Public disclosure of the vulnerability and exploit details.
2026-07-26: advisory: NVD published the CVE record.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.