Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Tapestry

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-61899

    Apache Tapestry: Possible classpath file download through URL manipulation

    Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

    Apache Software Foundation Apache Tapestry
  • High 7.5
    CVE-2022-31781

    Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)

    Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this…

    Apache Software Foundation Apache Tapestry org.apache.tapestry:tapestry-core Maven
  • High 7.5
    CVE-2021-30638

    An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later

    Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapest…

    Apache Software Foundation Apache Tapestry org.apache.tapestry:tapestry-core Maven