CVE-2026-94251: Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource
Low-severity vulnerability in Apache Sling Security Bundle where ContentDispositionFilter misses certain resource address shapes, fixed in v1.3.12.
A low-severity vulnerability, CVE-2026-94251, has been reported in the Apache Sling Security Bundle. The ContentDispositionFilter incorrectly mediates only one address/API shape of a resource, potentially leaving it unprotected. Users should upgrade to version 1.3.12 to fix the issue.
- Low-severity vulnerability in Apache Sling Security Bundle.
- ContentDispositionFilter fails to mediate all resource address shapes.
- Patched in version 1.3.12.
- CVEs
- CVE-2026-94251
- Vendors
- Apache
- Products
- Apache Sling Security Bundle
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94251 | Content-Disposition filter bypass in Apache Sling Security Bundle before 1.3.12 | 6.5 | — |
From the original article
Posted by Joerg Hoh on Sep 23 Severity: low Affected versions: - Apache Sling Security Bundle before 1. 3. 12 Description: A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache Sling Security Bundle: before 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.