The vulnerability CVE-2026-17459 affects the perwendel spark Java framework versions 2.9.0 through 2.9.4. It arises from the staticFiles.externalLocation function in the ExternalResourceHandler.java component, which improperly handles symbolic links, allowing an attacker to cause symlink following. This can be triggered remotely without user interaction or privileges beyond low-level access. The issue was reported early to the project but has not yet received a response or fix. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation allows remote attackers to cause the application to follow symbolic links, potentially exposing or accessing unintended files or directories. This could lead to information disclosure or other impacts depending on the symlink target. The vulnerability does not require privileges or user interaction, increasing its risk. However, no known exploits in the wild have been reported.

No official patch or remediation is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to external static file locations or applying manual controls to prevent symlink exploitation where feasible.