CVE-2026-61899 is a vulnerability in the tapestry-core component of Apache Tapestry affecting versions 5.5.0 and later up to but not including 5.9.1. The flaw allows attackers to access and download classpath assets by crafting specific URLs, resulting in exposure of sensitive information (CWE-200). The vulnerability affects all platforms running the vulnerable versions. No CVSS score is provided, and no known exploits in the wild have been reported. The vendor recommends upgrading to Apache Tapestry 5.9.1 to address this issue.

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information contained in classpath assets. This may expose internal application data or configuration details to attackers, potentially aiding further attacks or information gathering. There are no reports of active exploitation in the wild at this time.

Users should upgrade Apache Tapestry to version 5.9.1 or later, where this vulnerability has been fixed. No other mitigation or temporary workaround is indicated by the vendor or advisory. Patch status is confirmed by the vendor recommendation to upgrade.