Executive brief
Apache Sling Security Bundle is a Java library that manages security policies for the Apache Sling web framework. The ContentDispositionFilter component only applies security filtering rules to one API endpoint shape, leaving other API paths unprotected and allowing attackers to access resources that should be restricted.
Technical details
The ContentDispositionFilter in Apache Sling Security Bundle fails to normalize or consistently apply content disposition filtering across multiple address/API shapes of the same resource, allowing an attacker to bypass content security policies by accessing the resource through an unfiltered API path. This is a logic flaw in the security enforcement mechanism that requires network access to the vulnerable application. A fix is available in version 1.3.12.
Affected products
- Apache Sling Security Bundle before 1.3.12
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in version 1.3.12