Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-9159

21
FAUCET Score

CVE-2018-9159 describes a directory traversal vulnerability in Spark prior to version 2.7.2, allowing remote attackers to read arbitrary static files through crafted absolute or relative pathnames, including file: URLs. This vulnerability has a CVSS score of 5.3 (Medium), indicating it can be exploited remotely with low attack complexity, resulting in a potential loss of confidentiality. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.7.2CPE matchmatch criteria
cpe:2.3:a:sparkjava:spark:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

5.3MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
1.4
CvssVersion
3.0

Exploit Intelligence

EPSS Score
4.60%
Probability of exploitation in next 30 days
EPSS Percentile
90.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
This CVE's current EPSS score of 0.0460 is in the 87th percentile among its peer group of 23,690 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (7)

github_advisorypatch availablevia nvd_reference
View patch
mavenpatch availablevia ghsa
Product: com.sparkjava:spark-coreFixed in: 2.7.2
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Fuse 6.3Fixed in: camel
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss A-MQ 6.3Fixed in: camel
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R7Fixed in: spark-core
View patch
redhatno patchvia redhat_api
Product: Red Hat Fuse 7Fixed in: camel
redhatno patchvia redhat_api
Product: Red Hat JBoss Fuse Integration Service 2Fixed in: spark-core

Vendor Advisories (2)

mavenGHSA-76qr-mmh8-cp8fmedium

Moderate severity vulnerability that affects com.sparkjava:spark-core

Oct 19, 2018
redhatCVE-2018-9159Moderate

spark: Absolute and relative pathnames allow for unintended static file disclosure

Mar 6, 2018

References

access.redhat.com / errata/RHSA-2018:2020
Third Party Advisory
access.redhat.com / errata/RHSA-2018:2405
Third Party Advisory
github.com / perwendel/spark/commit/030e9d00125cbd1ad759668f85488aba1019c668
PatchThird Party Advisory
github.com / perwendel/spark/commit/a221a864db28eb736d36041df2fa6eb8839fc5cd
PatchThird Party Advisory
github.com / perwendel/spark/commit/ce9e11517eca69e58ed4378d1e47a02bd06863cc
PatchThird Party Advisory
github.com / perwendel/spark/issues/981
Issue TrackingThird Party Advisory
sparkjava.com / news
Vendor Advisory