CVE-2026-17459 is a medium severity vulnerability in the perwendel spark framework affecting versions 2.9.0 through 2.9.4. It involves symlink following in the staticFiles.externalLocation function of the ExternalResourceHandler.java file. This flaw can be triggered remotely without user interaction and requires low privileges. The vulnerability was responsibly disclosed early to the project, but no patch or official remediation has been provided as of the publication date.

Successful exploitation allows remote attackers to manipulate the handling of symbolic links in static file serving, potentially leading to unauthorized file access or information disclosure. The vulnerability requires low attack complexity and no user interaction, but privileges are low. No confirmed exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor response is available, users should consider restricting access to the affected functionality or implementing compensating controls to prevent symlink exploitation until a patch is released.