The vulnerability resides in SparkJava’s ExternalResourceHandler, where the staticFiles.externalLocation method processes user-supplied paths and can follow symbolic links. By crafting a request that points to a symlink, an attacker can cause the server to resolve and expose arbitrary files on the host, resulting in potential information disclosure.

The issue affects the perwendel spark framework up to and including version 2.9.4. Any deployment using SparkJava’s static file serving feature with that function is susceptible; newer releases (beyond 2.9.4) may contain the fix.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is less than 1%, pointing to a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack is remotely achievable via HTTP requests that manipulate the staticFiles.externalLocation parameter, and the exploit has been publicly disclosed, meaning attackers could try it if the target remains unpatched.