Advisoriesby IbisVMwareCVE-2026-59294
VMware Spring AI: path traversal
No fix yet
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there.
Spring AI 2.0.0
Spring AI 1.1.0 - 1.1.8
Spring AI 1.0.9 and earlier
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Spring AI Product | <= 2.0.0 | No fix yet |
| >= 1.1.0, <= 1.1.8 | No fix yet | |
| <= 1.0.9 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-22