Sign in Subscribe

← All advisories

High severity7.5NVD Advisory· Published Nov 4, 2016· Updated May 6, 2026

CVE-2016-9177

CVE-2016-9177

Description

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.sparkjava:spark-coreMaven	< 2.5.2	2.5.2

Affected products

1

Sparkjava/Spark
cpe:2.3:a:sparkjava:spark:*:*:*:*:*:*:*:*
Range: <=2.5

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

github.com/perwendel/spark/issues/700nvdIssue TrackingPatchThird Party AdvisoryWEB
seclists.org/fulldisclosure/2016/Nov/13nvdExploitMailing ListThird Party AdvisoryWEB
www.securityfocus.com/bid/94218nvdThird Party AdvisoryVDB EntryWEB
github.com/advisories/GHSA-89gc-6cw6-4vchghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2016-9177ghsaADVISORY
access.redhat.com/errata/RHSA-2017:0868nvdWEB

News mentions

0

No linked articles in our index yet.