CVE-2018-9159: In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of ab...

Security readout for executives and security teams

CVE-2018-9159 affects Spark before 2.7.2. A remote user could make the application serve files that were not intended to be public by abusing alternate path formats. For businesses, the concern is unintended disclosure of local files from systems running affected Spark-based applications. Exposure is likely limited to applications using Spark before 2.7.2 with static file handling reachable by untrusted users. The bundle does not identify broader affected products beyond Spark and Red Hat advisories. Treat as a targeted remediation item for affected Spark applications. Prioritize internet-facing systems and applications handling sensitive local files, but do not escalate as emergency without evidence of exposure or exploitation. Mitigation focus: Upgrade Spark to 2.7.2 or a later supported version.; Review Red Hat advisories if using downstream packaged Spark components.; Inventory internet-facing applications that embed Spark before 2.7.2..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.