{"id":"CVE-2019-0207","aliases":["EUVD-2019-0738","GHSA-89r3-rcpj-h7w6"],"status":"published","title":"Path traversal attack on Windows platforms","description":"Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -\u003e AssetDispatcher -\u003e ContextResource`, which doesn't filter the character `\\`, so attacker can perform a path traversal attack to read any files on Windows platform.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03094,"percentile":0.87815,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2019-09-16T16:36:14Z","modified":"2026-10-24T10:30:46Z","exploits":[{"source":"pocgithub","id":"shoucheng3/asf__tapestry-5_CVE-2019-0207_5-4-4","title":"shoucheng3/asf__tapestry-5_CVE-2019-0207_5-4-4","date":"2025-08-16","url":"https://github.com/shoucheng3/asf__tapestry-5_CVE-2019-0207_5-4-4"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.tapestry:tapestry-core","fixed_in":["5.4.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tapestry:tapestry-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tapestry:tapestry-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.0"},{"fixed":"5.4.5"}]}],"versions":["5.4.0","5.4.1","5.4.2","5.4.3","5.4.4"]}],"products":[{"vendor":"apache","product":"apache tapestry"},{"vendor":"apache","product":"tapestry"},{"vendor":"apache software foundation","product":"apache tapestry"}],"references":[{"url":"https://lists.apache.org/thread.html/765be3606d865de513f6df9288842c3cf58b09a987c617a535f2b99d%40%3Cusers.tapestry.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c%40%3Cusers.tapestry.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r87523dd07886223aa086edc25fe9b8ddb9c1090f7db25b068dc30843%40%3Ccommits.tapestry.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c%40%3Ccommits.tapestry.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0207","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/765be3606d865de513f6df9288842c3cf58b09a987c617a535f2b99d@%3Cusers.tapestry.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c@%3Cusers.tapestry.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c@%3Ccommits.tapestry.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r87523dd07886223aa086edc25fe9b8ddb9c1090f7db25b068dc30843@%3Ccommits.tapestry.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-89r3-rcpj-h7w6"}],"sources":{"cve":[{"id":"CVE-2019-0207","description":"Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -\u003e AssetDispatcher -\u003e ContextResource`, which doesn't filter the character `\\`, so attacker can perform a path traversal attack to read any files on Windows platform.","status":"published","published":"2019-09-16T16:36:14Z","modified":"2024-08-04T17:44:15.383Z","updated_at":"2026-11-02T14:32:24.473448Z"}],"euvd":[{"id":"EUVD-2019-0738","description":"Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -\u003e AssetDispatcher -\u003e ContextResource`, which doesn't filter the character `\\`, so attacker can perform a path traversal attack to read any files on Windows platform.","status":"published","published":"2019-09-16T16:36:14Z","modified":"2024-08-04T17:44:15Z","updated_at":"2026-11-03T03:07:02.049822Z"}],"ghsa":[{"id":"GHSA-89r3-rcpj-h7w6","title":"Path traversal attack on Windows platforms","description":"Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -\u003e AssetDispatcher -\u003e ContextResource`, which doesn't filter the character `\\`, so attacker can perform a path traversal attack to read any files on Windows platform.","status":"published","published":"2019-11-18T17:19:03Z","modified":"2023-03-06T20:46:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:47.279442Z"}],"nvd":[{"id":"CVE-2019-0207","description":"Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -\u003e AssetDispatcher -\u003e ContextResource`, which doesn't filter the character `\\`, so attacker can perform a path traversal attack to read any files on Windows platform.","status":"published","published":"2019-09-16T17:15:13.183Z","modified":"2026-06-17T02:07:58.36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:28.126831Z"}],"osv":[{"id":"CVE-2019-0207","description":"Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -\u003e AssetDispatcher -\u003e ContextResource`, which doesn't filter the character `\\`, so attacker can perform a path traversal attack to read any files on Windows platform.","status":"published","published":"2019-09-16T17:15:13.183Z","modified":"2026-10-24T10:30:46.138816502Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"GHSA-89r3-rcpj-h7w6","title":"Path traversal attack on Windows platforms","description":"Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -\u003e AssetDispatcher -\u003e ContextResource`, which doesn't filter the character `\\`, so attacker can perform a path traversal attack to read any files on Windows platform.","status":"published","published":"2019-11-18T17:19:03Z","modified":"2023-11-08T04:00:31.355832Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:42.077781Z"}]}}