CVE-2021-30638: Apache Tapestry

High severity, CVSS 7.5. EPSS: 6.6% chance of exploitation in the next 30 days.

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.

Affected products

• Apache Tapestry: from 5.4.0, before 5.6.4 (fixed in 5.6.4); from 5.7.0, before 5.7.2 (fixed in 5.7.2)

Published 2021-04-27. Last modified 2026-06-17.