CVE-2018-9159: com.sparkjava:spark-core - Unintended File Access
Summary
CVE-2018-9159: Moderate severity vulnerability that affects com.sparkjava:spark-core. Affects com.sparkjava:spark-core versions < 2.7.2. Fixed in 2.7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.sparkjava:spark-core is a Maven package that provides a lightweight web framework for Java applications. It enables developers to build RESTful web services and applications with ease. However, versions prior to 2.7.2 are susceptible to a moderate severity vulnerability.
Vulnerability Detail
The vulnerability in com.sparkjava:spark-core (CVE-2018-9159) allows a remote attacker to read unintended static files by exploiting various representations of absolute or relative pathnames. This can be achieved through file: URLs and directory traversal sequences. The issue was identified in Spark versions before 2.7.2. It is important to note that this vulnerability is unrelated to Ignite Realtime Spark. The impact of this vulnerability can lead to unauthorized access to sensitive files, potentially exposing sensitive information.
How To Fix
Latest published version: 2.9.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.7.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of com.sparkjava:spark-core to ensure the security of the application.
Conclusion
The vulnerability in com.sparkjava:spark-core (CVE-2018-9159) allows remote attackers to access unintended static files. It is crucial to update to version 2.7.2 or later to mitigate this issue. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.sparkjava:spark-core →
FAQ
com.sparkjava:spark-core is a lightweight web framework for Java applications, allowing developers to build RESTful web services and applications.
The vulnerability allows remote attackers to read unintended static files, potentially exposing sensitive information.
Versions prior to 2.7.2 are affected by this vulnerability.
No, there is no known workaround. Updating to the fixed version is necessary.
To fix this vulnerability, upgrade to version 2.7.2 or later of com.sparkjava:spark-core.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.sparkjava:spark-core.
