What’s Vulnerable › Vulnerabilities

CVE-2018-9159

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-31 · updated 2026-06-17
• Weakness: CWE-22

Description

In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.

Affected products

• Sparkjava Spark: before 2.7.2 — fixed in 2.7.2

How to fix

Upgrade to a fixed version: Sparkjava Spark 2.7.2. Check the vendor advisory for mitigations.

References

• http://sparkjava.com/news#spark-272-released
• https://access.redhat.com/errata/RHSA-2018:2020
• https://access.redhat.com/errata/RHSA-2018:2405
• https://github.com/perwendel/spark/commit/030e9d00125cbd1ad759668f85488aba1019c668
• https://github.com/perwendel/spark/commit/a221a864db28eb736d36041df2fa6eb8839fc5cd
• https://github.com/perwendel/spark/commit/ce9e11517eca69e58ed4378d1e47a02bd06863cc
• https://github.com/perwendel/spark/issues/981
• http://sparkjava.com/news#spark-272-released
• https://access.redhat.com/errata/RHSA-2018:2020
• https://access.redhat.com/errata/RHSA-2018:2405
• https://github.com/perwendel/spark/commit/030e9d00125cbd1ad759668f85488aba1019c668
• https://github.com/perwendel/spark/commit/a221a864db28eb736d36041df2fa6eb8839fc5cd

Get alerted when CVE-2018-9159 or the next vulnerability affects your stack