Skip to content
fr Sign in
5.9 Medium

CVE-2026-59294 ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without…

Description

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.9 and earlier

Affected products and versions

Product Affected versions Fixed in
Spring AI 2.0.0 No fix stated
Spring AI 1.1 1.1.0 → 1.1.8 No fix stated
Spring AI 1.0 earliest → 1.0.9 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring AI

The 18 CVEs of Spring AI →
CVE-2026-59319 RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values… 4.3 Medium CVE-2026-47852 A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file 7.5 High CVE-2026-47851 Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread 7.5 High CVE-2026-59318 In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully… 6.5 Medium
Track this CVE