CVE-2026-94251: Apache Sling Security Bundle Auth Bypass

CVE-2026-94251 Overview

CVE-2026-94251 affects the Apache Sling Security Bundle, specifically the ContentDispositionFilter component. The filter mediates only one address or API shape of a given resource, allowing attackers to bypass the protection by requesting the same resource through an alternate path or API. This weakness is tracked as an improper protection mechanism failure [CWE-693]. Apache Sling Security Bundle versions before 1.3.12 are affected. The Apache Sling project recommends upgrading to version 1.3.12, which addresses the flaw.

Critical Impact
Attackers can bypass content disposition enforcement over the network without authentication, leading to limited confidentiality and integrity impact on protected resources served by Apache Sling.

Affected Products

Apache Sling Security Bundle versions before 1.3.12
Applications embedding vulnerable versions of the Apache Sling Security Bundle
Apache Sling deployments relying on ContentDispositionFilter for download enforcement

Discovery Timeline

2026-09-23 - CVE-2026-94251 published to the National Vulnerability Database
2026-09-23 - Advisory posted to the Apache mailing list and Openwall OSS-Security
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-94251

Vulnerability Analysis

Apache Sling exposes resources through multiple addressing schemes. A single resource can typically be reached via its resource path, an aliased path, or by different selectors, extensions, and suffixes. The ContentDispositionFilter is designed to force Content-Disposition: attachment headers on responses for configured paths. This prevents browsers from rendering user-uploaded content inline, mitigating cross-site scripting and drive-by download risks.

The filter, however, evaluates only one address or API shape of a resource. Requests routed through a different but equivalent URL form reach the same underlying resource without the filter attaching the disposition header. The response is then served inline, defeating the protection.

Root Cause

The defect is a protection mechanism failure classified under [CWE-693]. The filter logic normalizes or matches only a subset of the possible request forms that Sling accepts for a resource. Alternate resource identifiers, extensions, or selectors are not canonicalized before the filter decision is made. As a result, the security control is only partially enforced.

Attack Vector

An unauthenticated remote attacker crafts an HTTP request that targets a protected resource using an alternate URL shape, such as a different extension, selector, alias, or suffix that resolves to the same content. The Sling resource resolver returns the resource, but the ContentDispositionFilter does not apply the attachment header. Depending on the content type, the browser renders the response inline. This can be chained with malicious file uploads to achieve stored cross-site scripting or content spoofing against authenticated users of the site.

No verified proof-of-concept code has been published. See the Apache Mailing List Discussion and the Openwall OSS Security Update for the advisory text.

Detection Methods for CVE-2026-94251

Indicators of Compromise

HTTP responses from Sling endpoints returning user-uploaded content without a Content-Disposition: attachment header when the resource path would normally trigger it.
Access log entries requesting the same resource through multiple URL variants, including uncommon selectors, extensions, or aliases.
Uploads of HTML, SVG, or script-bearing files followed by requests to alternate resource addresses shortly afterward.

Detection Strategies

Inventory all deployed Apache Sling instances and identify the version of the Security Bundle in use, flagging any release earlier than 1.3.12.
Compare response headers for identical resources fetched through canonical and alternate URLs to detect inconsistent enforcement of ContentDispositionFilter.
Review web application firewall and reverse proxy logs for anomalous request patterns targeting Sling resource resolution paths.

Monitoring Recommendations

Alert on HTTP responses that lack expected Content-Disposition headers for paths under filter configuration.
Monitor Sling audit logs for repeated resource lookups against the same node identifier through distinct request URIs.
Track file uploads of high-risk MIME types and correlate with subsequent fetch requests from external clients.

How to Mitigate CVE-2026-94251

Immediate Actions Required

Upgrade the Apache Sling Security Bundle to version 1.3.12 or later across all environments.
Audit the ContentDispositionFilter configuration and confirm coverage of every path that serves user-uploaded content.
Restrict upload of active content types such as HTML, SVG, and JavaScript until the patched bundle is deployed.

Patch Information

The Apache Sling project released Apache Sling Security Bundle version 1.3.12 to fix CVE-2026-94251. Operators should redeploy the updated bundle to their Sling instances and restart the OSGi container to load the new version. Confirm the fix by verifying the installed bundle version in the OSGi console.

Workarounds

Place a reverse proxy or web application firewall in front of Sling to append Content-Disposition: attachment headers for responses serving user-generated content.
Restrict access to alternate resource addressing forms by tightening URL rewriting rules and disabling unused selectors or extensions.
Enforce strict MIME type validation on upload endpoints to prevent storage of executable web content.

bash

# Configuration example
# Verify installed Apache Sling Security Bundle version via OSGi console
curl -u admin:admin http://sling-host:8080/system/console/bundles.json \
  | jq '.data[] | select(.symbolicName=="org.apache.sling.security") | {version}'