CVE-2018-9159
Moderate severity vulnerability that affects com.sparkjava:spark-core
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
- Record
CVE-2018-9159- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
- Record
CVE-2018-9159- Updated
- 2026-11-02
EUVDEUVD-2018-0533 No score
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
- Record
EUVD-2018-0533- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-76qr-mmh8-cp8f
Moderate severity vulnerability that affects com.sparkjava:spark-core
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
- Record
GHSA-76qr-mmh8-cp8f- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
- Record
CVE-2018-9159- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-76qr-mmh8-cp8f
Moderate severity vulnerability that affects com.sparkjava:spark-core
In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
- Record
GHSA-76qr-mmh8-cp8f- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVSUSE-RU-2018:2639-1 No score
Recommended update for SUSE Manager 3.1 Release Notes
This update for the SUSE Manager 3.0 Release Notes provides the following additions:
-
SUSE Manager Server bugs fixed by latest updates
- bsc#1057635, bsc#1083295, bsc#1087837, bsc#1089362, bsc#1089526, bsc#1089662, bsc#1093458, bsc#1096264, bsc#1096514, bsc#1097250, bsc#1097697, bsc#1098388, bsc#1098394, bsc#1098815, bsc#1098993, bsc#1099583, bsc#1099638, bsc#1099781, bsc#1100131, bsc#1100731, bsc#1101670, bsc#1102009, bsc#1103044, bsc#1103090, bsc#1103218, bsc#1104025, bsc#1104503, bsc#1105440, bsc#1105442
-
SUSE Manager Server security issues fixed by latest updates
- CVE-2018-1000225, CVE-2018-1000226, CVE-2018-9159
-
SUSE Manager Proxy bugs fixed by latest updates
- bsc#1083295, bsc#1094705, bsc#1097697
- Record
SUSE-RU-2018:2639-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2689-1 No score
Security update for spark
This update for spark fixes the following security issue:
- CVE-2018-9159: Fix a security problem in the serving of static files. (bsc#1087837)
- Record
SUSE-SU-2018:2689-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.sparkjava:spark-coreMaven |
before 2.7.2 | 2.7.2 |
com.sparkjava:spark-coreMaven |
before 2.7.2, plus listed versions 1.01.11.1.12.0.02.1 Show 13 moreShow less2.22.32.42.52.5.12.5.22.5.32.5.42.5.52.6.02.6.0.RC02.7.02.7.1 |
2.7.2 |
release-notes-susemanager-proxySUSE:Manager Proxy 3.1 |
before 3.1.8-0.15.29.1 | 3.1.8-0.15.29.1 |
release-notes-susemanagerSUSE:Manager Server 3.1 |
before 3.1.8-5.38.1 | 3.1.8-5.38.1 |
sparkSUSE:Manager Server 3.1 |
before 2.3-3.3.1 | 2.3-3.3.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | shoucheng3/perwendel__spark_CVE-2018-9159_2-7-1 | 2025-08-20 |
| PoC in GitHub | shoucheng3/perwendel__spark_CVE-2018-9159_2_7_2_fixed | 2025-09-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-9159 is a medium vulnerability (CVSS 5.3) in Sparkjava Spark, published March 31, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.45%, the 91st percentile. Fixed in com.sparkjava:spark-core 2.7.2.
References
github.com/perwendel/spark/issues/981
access.redhat.com/errata/RHSA-2018:2020
sparkjava.com/news
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-9159
suse.com/support/update/announcement//suse-ru-20182639-1
bugzilla.suse.com/1087837