Spark allows remote attackers to read arbitrary files via a .. (dot dot) in the URI

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

Vulnerability ID: GHSA-89gc-6cw6-4vch
Aliases: CVE-2016-9177
Published: 2018-10-04 19:53:35
CWE: CWE-22
Severity rating: HIGH
CVSS: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven
name: com.sparkjava:spark-core