CVE-2026-17459: Perwendel Spark RCE Vulnerability

CVE-2026-17459 Overview

CVE-2026-17459 is a symlink following vulnerability [CWE-59] in the perwendel Spark framework (SparkJava) affecting versions up to 2.9.4. The flaw resides in the staticFiles.externalLocation function within src/main/java/spark/resource/ExternalResourceHandler.java. An attacker with low privileges can manipulate symbolic links within the configured external static-files directory to cause the server to serve files outside the intended location. The attack is executable remotely over the network. The exploit has been publicly disclosed. At the time of publication, the maintainers had not responded to the issue report.

Critical Impact
Remote attackers can leverage symlink following to read unintended files served by SparkJava's external static-file handler, exposing configuration or application data.

Affected Products

perwendel Spark (SparkJava) up to and including version 2.9.4
Component: ExternalResourceHandler (src/main/java/spark/resource/ExternalResourceHandler.java)
Feature: staticFiles.externalLocation

Discovery Timeline

2026-07-26 - CVE-2026-17459 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-17459

Vulnerability Analysis

SparkJava exposes a static-file serving feature via staticFiles.externalLocation, which maps a filesystem directory to HTTP-accessible resources. The ExternalResourceHandler resolves incoming requests to files within that directory. The handler does not verify whether resolved paths cross the intended directory boundary through symbolic links. When a symlink inside the configured directory targets an external file, the handler follows the link and returns its contents to the requesting client.

The vulnerability affects confidentiality of files reachable by the Spark process user. It does not directly enable code execution or write access. Exploitation requires that an attacker either place a symlink in the served directory or influence an environment where such symlinks already exist.

Root Cause

The root cause is missing symlink validation in the file-resolution path of ExternalResourceHandler. The handler resolves requested paths without checking whether the canonical target remains inside the configured base directory. This aligns with [CWE-59: Improper Link Resolution Before File Access ('Link Following')].

Attack Vector

The attack is delivered over the network against a Spark application configured with staticFiles.externalLocation. An attacker who can plant a symlink in the served directory, or who targets a deployment where user-uploaded content is stored there, can issue an HTTP request for that symlink path. The server follows the link and returns the target file contents. The public disclosure includes reproduction details in GitHub Spark Issue #1296.

No verified public exploit code was included in the referenced advisories. See the VulDB entry for CVE-2026-17459 for additional context.

Detection Methods for CVE-2026-17459

Indicators of Compromise

HTTP requests to static-file paths that resolve, on disk, to symbolic links pointing outside the configured externalLocation directory.
Access log entries requesting file paths under the static-file route that correspond to sensitive filenames (for example, configuration or credential files).
Unexpected symlinks appearing in the directory configured for staticFiles.externalLocation.

Detection Strategies

Audit the directory referenced by staticFiles.externalLocation for symbolic links and validate each target.
Review Spark application source for calls to staticFiles.externalLocation and correlate configured paths with directories that accept untrusted writes.
Enable HTTP access logging on Spark endpoints and search for requests that resolve to paths outside the intended web root.

Monitoring Recommendations

Alert on creation of symlinks in directories served by SparkJava, using filesystem auditing tools such as auditd on Linux.
Monitor Spark process file-open events for reads outside the configured static-file directory.
Track upstream activity on GitHub Spark Issue #1296 for patch availability.

How to Mitigate CVE-2026-17459

Immediate Actions Required

Inventory all applications that call Spark.staticFiles.externalLocation(...) and identify the directories they expose.
Remove any existing symlinks from those directories and restrict write access to trusted operators only.
Ensure the Spark process runs as an unprivileged account with filesystem permissions scoped strictly to the intended static-file directory.

Patch Information

At the time of publication, the perwendel/spark project had not released a fix. Monitor the perwendel/spark repository and issue #1296 for a patched release beyond version 2.9.4.

Workarounds

Serve static content from staticFiles.location (classpath resources) instead of staticFiles.externalLocation where feasible, since classpath resources are not subject to filesystem symlink resolution.
Place the external static directory on a filesystem mount configured with the nosymfollow option, or use a chroot/container boundary so symlink targets cannot escape the directory.
Front SparkJava with a reverse proxy such as Nginx configured with disable_symlinks on; to reject symlink resolution before requests reach Spark.

bash

# Example Nginx directive to block symlink following in front of SparkJava
location /static/ {
    disable_symlinks on;
    proxy_pass http://spark-backend;
}