Executive brief
SparkJava, a popular lightweight web framework for Java, contains a vulnerability in how it handles external static files. An attacker can exploit this to read sensitive files on the server that should be inaccessible, potentially leading to the exposure of configuration data or system credentials. This occurs because the software fails to prevent access through symbolic links to locations outside the intended web directory.
Technical details
A symlink following vulnerability exists in SparkJava (perwendel spark) up to version 2.9.4 within the `staticFiles.externalLocation` function of `ExternalResourceHandler.java`. The root cause is improper link resolution (CWE-59/CWE-61), where the application fails to validate that a requested file resides within the intended base directory when symbolic links are present. A remote attacker with low privileges can exploit this by accessing a crafted URL that resolves to a symlink pointing outside the static root, enabling unauthorized local file read. As of the advisory date, the project has been notified via an issue report but a formal patch has not been confirmed.
Affected products
- perwendel spark up to 2.9.4
Timeline
- 2026-07-26: disclosed: Public disclosure of the vulnerability and exploit details.
- 2026-07-26: advisory: NVD published the CVE record.