CVE-2026-59294

medium VMware
CVSS v3 Base Score
5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
EPSS Score
0.3%
Exploitation probability in 30 days
Top 84% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Published: August 27, 2026 (9 days ago)
Last Modified: August 31, 2026
Vendor: VMware
Source: NVD

Description

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.9 and earlier

CWE

CWE-22

Affected Products

vmware spring ai

References

🔗 spring.io