Executive brief
Apache Tapestry is a web application framework used to build enterprise Java web applications. A vulnerability in versions 5.5.0 and later allows attackers to bypass asset access controls and download classpath files by crafting specially designed URLs, potentially exposing sensitive configuration files, source code, or other classpath resources.
Technical details
The vulnerability is a path traversal flaw in tapestry-core's asset handling mechanism. Attackers can craft malicious URLs to access classpath assets that should not be publicly downloadable, bypassing the framework's normal access restrictions. The attack is network-accessible and requires no authentication or user interaction. An attacker can retrieve arbitrary classpath resources, which may include application configuration files, private keys, or other sensitive data embedded in the application jar. The vulnerability is patched in version 5.9.1.
Affected products
- Apache Tapestry 5.5.0 to 5.9.0
Timeline
- 2026-08-10: disclosed