CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 6.5. See the original NVD description below for full technical details.
CVE
CVE-2026-41863
Severity
MEDIUM
CVSS
6.5
EPSS
0.40%
Original NVD Description
Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories. Affected versions: Spring AI: 1.1.0 through 1.1.x
Related CVEs
Other vulnerabilities affecting the same vendor(s)