CVE-2019-0207: Apache Tapestry

High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days.

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.

Affected products

• Apache Tapestry: from 5.4.0, up to and including 5.4.4

Published 2019-09-16. Last modified 2026-06-17.