Vulnerability in tapestry‑core of Apache Tapestry 5.5.0+ permits unauthenticated attackers to download classpath assets via crafted URLs. The flaw stems from insufficient input validation on resource paths, allowing the application to serve files that reside within the application’s classpath. Successful exploitation leads to unauthorized disclosure of potentially sensitive files, thereby compromising confidentiality. The weakness maps to CWE‑200.

Apache Software Foundation’s Apache Tapestry web framework, specifically the tapestry‑core component, is affected. All releases from 5.5.0 up to but not including 5.9.1 on any supported platform are vulnerable. Users are advised to upgrade to at least 5.9.1, which includes a patch that validates resource paths and removes the export of classpath assets.

Attackers can exploit this flaw remotely by sending a HTTP request containing a specially crafted path. The vulnerability requires no special privileges and can be triggered from any network position that can reach the application, making it a high‑risk exposure for publicly exposed services. No EPSS score is available and the issue is not listed in the CISA KEV catalog, but the lack of an exploitation probability metric does not diminish the potential impact. The fix is available via an official patch; until applied, the best mitigations are to block resource path traversal at the web layer and to restrict access to classpath directories.