CVE-2026-61899: Apache Tapestry Information Disclosure

CVE-2026-61899 Overview

CVE-2026-61899 is an information disclosure vulnerability in tapestry-core affecting Apache Tapestry 5.5.0 and later. Attackers can download classpath assets through specially crafted URLs without authentication. The flaw stems from insufficient access controls on asset resource handling, mapped to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. Remote unauthenticated attackers can retrieve internal application resources over the network. Apache has released version 5.9.1 to address the issue.

Critical Impact
Unauthenticated remote attackers can retrieve arbitrary classpath assets from vulnerable Apache Tapestry deployments, exposing sensitive application resources.

Affected Products

Apache Tapestry tapestry-core version 5.5.0 and later
Apache Tapestry releases prior to 5.9.1
Java web applications built on the affected framework versions

Discovery Timeline

2026-08-10 - CVE-2026-61899 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-61899

Vulnerability Analysis

Apache Tapestry serves static resources such as JavaScript, CSS, and images through a classpath asset dispatcher. The dispatcher maps request URLs to resources packaged inside the application's classpath, including framework libraries and dependencies. In versions 5.5.0 through 5.9.0, the URL parsing logic does not adequately restrict which classpath resources callers can request. Attackers craft URLs that resolve to non-asset resources on the classpath and retrieve their contents over HTTP.

The vulnerability affects confidentiality only. It does not permit modification of application data or disruption of service. Attackers can still retrieve compiled class files, configuration templates, and other bundled artifacts that assist further exploitation. Exposure of internal class files can reveal implementation logic, hardcoded values, and third-party library versions used to plan follow-on attacks.

Root Cause

The root cause is insufficient validation in the classpath asset URL handler within tapestry-core. The handler treats resources reachable through the classloader as servable assets without enforcing a strict allowlist of asset directories. Requests referencing resources outside the intended asset paths still return content when the classloader can locate them.

Attack Vector

An unauthenticated remote attacker sends specially crafted HTTP requests to the asset dispatcher endpoint. No user interaction or prior access is required. The attacker enumerates and downloads classpath resources by manipulating the asset URL structure that Tapestry uses for resource resolution. See the Apache Mailing List Thread and the OpenWall OSS Security Post for details.

No public proof-of-concept code has been verified. The vulnerability is described in prose only.

Detection Methods for CVE-2026-61899

Indicators of Compromise

HTTP GET requests targeting Tapestry asset paths that resolve to .class, .properties, or configuration files instead of standard .js, .css, or image assets.
Repeated requests with anomalous path traversal patterns or unusual asset URL structures aimed at the Tapestry dispatcher.
Outbound response traffic containing Java class bytecode signatures returned from asset endpoints.

Detection Strategies

Inspect web server and application logs for asset requests that return non-standard MIME types or unusually large response payloads.
Deploy web application firewall rules to flag URLs containing classpath references such as package paths, META-INF, or WEB-INF fragments.
Correlate multiple sequential asset requests from a single source that enumerate framework internals.

Monitoring Recommendations

Enable verbose access logging on Tapestry asset endpoints and forward logs to a centralized SIEM for retention and analysis.
Alert on responses from asset URLs containing Java class file magic bytes (0xCAFEBABE) or serialized configuration content.
Baseline normal asset request patterns and generate alerts when request URIs deviate from expected static resource paths.

How to Mitigate CVE-2026-61899

Immediate Actions Required

Upgrade all Apache Tapestry deployments to version 5.9.1 or later without delay.
Audit application logs for prior requests that may have retrieved sensitive classpath assets before patching.
Rotate any secrets or credentials that may have been embedded in bundled configuration files exposed by the flaw.

Patch Information

Apache has released Apache Tapestry 5.9.1, which resolves the classpath asset exposure. Upgrade the tapestry-core dependency in the project's build configuration and redeploy the application. Refer to the Apache Mailing List Thread for the official announcement.

Workarounds

Place a reverse proxy or web application firewall in front of the application to restrict asset URLs to expected static file extensions.
Deny external access to asset paths that resolve to Java package structures until the patched version is deployed.
Remove sensitive configuration files, credentials, and secrets from the application classpath and load them from external secret stores.

bash

# Example Maven dependency upgrade for tapestry-core
<dependency>
    <groupId>org.apache.tapestry</groupId>
    <artifactId>tapestry-core</artifactId>
    <version>5.9.1</version>
</dependency>