CVE-2021-30638

An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later

7.5 HighFix available

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

6.56%Up 5.9 points since Apr 28, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2021-30638
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200, CWE-863
Updated: 2026-11-02

CVE List No score

An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later

Record: CVE-2021-30638
Weakness: CWE-200
Updated: 2026-11-02

EUVDEUVD-2022-1426 No score

Record: EUVD-2022-1426
Updated: 2026-11-03

GitHub AdvisoriesGHSA-ghm8-mmx7-xvg2 7.5

Information Exposure in Apache Tapestry

Record: GHSA-ghm8-mmx7-xvg2
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-863
Updated: 2026-11-02

OSV 7.5

Record: CVE-2021-30638
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-ghm8-mmx7-xvg2 7.5

Information Exposure in Apache Tapestry

Record: GHSA-ghm8-mmx7-xvg2
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-863
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.tapestry:tapestry-core` Maven	5.4.0 up to 5.6.4	5.6.4
`org.apache.tapestry:tapestry-core` Maven	5.7.0 up to 5.7.2	5.7.2
`org.apache.tapestry:tapestry-core` Maven	5.4.0 up to 5.6.4, plus listed versions 5.4.15.4.25.4.35.4.45.4.5 Show 6 moreShow less 5.5.05.5.0-beta-35.6.05.6.15.6.25.6.3	5.6.4
`org.apache.tapestry:tapestry-core` Maven	5.7.0 up to 5.7.2, plus listed versions 5.7.1	5.7.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-30638 is a high vulnerability (CVSS 7.5) in Apache Tapestry, published April 27, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.56%, the 93rd percentile. Fixed in org.apache.tapestry:tapestry-core 5.6.4.