# org.apache.tapestry:tapestry-core (Maven) vulnerabilities 10 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.9.2 (Oct 28, 2026): no advisory affects it - Newest unaffected release: 5.9.2 (Oct 28, 2026), the latest release - Releases: 77 since 5.0.1 (Feb 2, 2007) - Registry: https://central.sonatype.com/artifact/org.apache.tapestry/tapestry-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-61899: 5.5.0 to 5.9.0-preview-2 (5.9.1 is outside it) - CVE-2022-46366: no published release is affected - CVE-2022-31781: 5.0.1 to 5.8.1 (5.8.2 is outside it) - CVE-2021-30638: 5.4.0 to 5.6.3 (5.6.4 is outside it); 5.7.0 to 5.7.1 (5.7.2 is outside it) - CVE-2021-27850: 5.4.0 to 5.6.2 (5.6.3 is outside it); 5.7.0 (5.7.1 is outside it) - CVE-2020-13953: 5.4.0 to 5.5.0 (5.6.0 is outside it) - CVE-2019-10071: 5.4.0 to 5.4.4 (5.4.5 is outside it) - CVE-2019-0207: 5.4.0 to 5.4.4 (5.4.5 is outside it) - CVE-2019-0195: 5.4.0 to 5.4.4 (5.4.5 is outside it) - CVE-2014-1972: 5.0.1 to 5.3.5 (5.3.6 is outside it) ## Advisories (10) ### [CVE-2026-61899](https://cve.now/CVE-2026-61899): Apache Tapestry: Possible classpath file download through URL manipulation - Severity: High 7.5 - Published: Aug 10, 2026 - Affected: from 5.5.0, fixed in 5.9.1. - Fixed in 5.9.1 (released Apr 7, 2026, 125 days before disclosure). - The latest release, 5.9.2, is not affected. ### [CVE-2022-46366](https://cve.now/CVE-2022-46366): Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input - Severity: Critical 9.8 - Published: Dec 2, 2022 - Affected: from 3.0, fixed in 5.0.1. - Fixed in 5.0.1 (released Feb 2, 2007, 5782 days before disclosure). - The latest release, 5.9.2, is not affected. ### [CVE-2022-31781](https://cve.now/CVE-2022-31781): Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022) - Severity: Unrated - Published: Jul 13, 2022 - Affected: fixed in 5.8.2. - Fixed in 5.8.2 (released Jun 15, 2022, 28 days before disclosure). - The latest release, 5.9.2, is not affected. ### [CVE-2021-30638](https://cve.now/CVE-2021-30638): An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later - Severity: Unrated - Published: Apr 27, 2021 - Affected: from 5.4.0, fixed in 5.6.4; from 5.7.0, fixed in 5.7.2. - Fixed in 5.6.4 (released Apr 8, 2021, 19 days before disclosure) and 5.7.2 (released Apr 8, 2021, 19 days before disclosure). - The latest release, 5.9.2, is not affected. ### [CVE-2021-27850](https://cve.now/CVE-2021-27850): Bypass of the fix for CVE-2019-0195 - Severity: Unrated - Published: Apr 15, 2021 - Affected: from 5.4.0, fixed in 5.6.3; from 5.7.0, fixed in 5.7.1. - Fixed in 5.6.3 (released Mar 9, 2021, 37 days before disclosure) and 5.7.1 (released Mar 9, 2021, 37 days before disclosure). - The latest release, 5.9.2, is not affected. ### [CVE-2020-13953](https://cve.now/CVE-2020-13953): In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being… - Severity: Unrated - Published: Sep 30, 2020 - Affected: from 5.4.0, fixed in 5.6.0. - Fixed in 5.6.0 (released Aug 23, 2020, 38 days before disclosure). - The latest release, 5.9.2, is not affected. ### [CVE-2019-10071](https://cve.now/CVE-2019-10071): The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the… - Severity: Unrated - Published: Sep 16, 2019 - Affected: from 5.4, fixed in 5.4.5. - Fixed in 5.4.5 (released Sep 3, 2019, 13 days before disclosure). - The latest release, 5.9.2, is not affected. ### [CVE-2019-0207](https://cve.now/CVE-2019-0207): Tapestry processes assets \`/assets/ctx\` using classes chain \`StaticFilesFilter -\> AssetDispatcher -\> ContextResource\`, which doesn't… - Severity: Unrated - Published: Sep 16, 2019 - Affected: from 5.4.0, fixed in 5.4.5. - Fixed in 5.4.5 (released Sep 3, 2019, 13 days before disclosure). - The latest release, 5.9.2, is not affected. ### [CVE-2019-0195](https://cve.now/CVE-2019-0195): Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. - Severity: Unrated - Published: Sep 16, 2019 - Affected: from 5.4.0, fixed in 5.4.5. - Fixed in 5.4.5 (released Sep 3, 2019, 13 days before disclosure). - The latest release, 5.9.2, is not affected. ### [CVE-2014-1972](https://cve.now/CVE-2014-1972): Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows… - Severity: Unrated - Published: Aug 22, 2015 - Affected: fixed in 5.3.6. - Fixed in 5.3.6 (released Oct 9, 2012, 1047 days before disclosure). - The latest release, 5.9.2, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.tapestry:tapestry-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.