https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T18:18:30.673128+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0646 certfr-2026-avi-0646 — Une vulnérabilité a été découverte dans Spring AI. Elle permet à un attaquant de provoquer une atteinte à l'intégrité d… 2026-10-05T18:18:30.725516+00:00 certfr-2026-avi-0646 https://cve.radiocsirt.org/vuln/euvd-2026-321355 EUVD-2026-321355 2026-10-05T18:18:30.725556+00:00 EUVD-2026-321355 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41863 fkie_cve-2026-41863 2026-10-05T18:18:30.725572+00:00

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.

Affected versions: Spring AI: 1.1.0 through 1.1.x

 https://cve.radiocsirt.org/vuln/ghsa-cc4m-mp48-x7qg GHSA-cc4m-mp48-x7qg — Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing… 2026-10-05T18:18:30.725602+00:00

Affected: Maven: org.springframework.ai:spring-ai-anthropic

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.

Affected versions: Spring AI: 1.1.0 through 1.1.7