CVE-2026-59294 — Arbitrary File Write via Path Traversal in ResourceCacheService

CVE-2026-59294

Arbitrary File Write via Path Traversal in ResourceCacheService PUBLISHED

Description (CNA)

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.9 and earlier

Affected (CNA)

Vendor / product	Versions
Spring / Spring AI	affected 2.0.0; affected 1.1.0 through 1.1.8; affected 0 through 1.0.9

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-59294

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.