CVE-2026-94251 in Sling
Summary
by MITRE • 09/23/2026
A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource
This issue affects Apache Sling Security Bundle: before 1.3.12.
Users are recommended to upgrade to version 1.3.12, which fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in the Apache Sling Security Bundle specifically within the ContentDispositionFilter component represents a critical oversight in access control logic related to resource mediation. This flaw arises because the filter is designed to enforce security policies and content disposition headers based on specific address patterns or API shapes, but it fails to account for all possible variations of these identifiers. In complex web application frameworks like Apache Sling, resources can often be accessed through multiple path structures, aliases, or normalized URL formats that map to the same underlying asset. When a security filter only validates one canonical form of a resource address while ignoring alternative representations, it creates an authorization bypass scenario where attackers can manipulate request paths to circumvent intended restrictions.
From a technical perspective, this issue is classified under CWE-284 Improper Access Control and aligns with ATT&CK technique T1078 Valid Accounts if the vulnerability allows unauthorized users to access restricted content by exploiting path variations. The root cause lies in the implementation of the ContentDispositionFilter which likely relies on exact string matching or a limited set of regex patterns for resource identification rather than resolving all possible paths to their canonical internal representation before applying security checks. This architectural weakness means that while direct requests to /content/myresource might be blocked, alternative access vectors such as using relative path traversal sequences, URL encoding variations, or Sling-specific selector and suffix manipulations could successfully retrieve the protected content without triggering the filter's denial logic.
The operational impact of this vulnerability is significant for any organization deploying Apache Sling in a production environment where sensitive documents or restricted APIs are served through this framework. Attackers can exploit this discrepancy to exfiltrate confidential data, access administrative endpoints, or manipulate system behavior by bypassing content disposition policies that are meant to prevent inline execution or unauthorized downloads. Since the vulnerability affects versions prior to 1.3.12, systems running older builds remain exposed to these path-based evasion techniques. The lack of comprehensive address normalization in the security filter effectively renders many access control rules ineffective against determined adversaries who understand the underlying request processing pipeline of Sling.
To mitigate this risk, immediate action is required by upgrading the Apache Sling Security Bundle to version 1.3.12 or later where the ContentDispositionFilter has been patched to normalize and validate all incoming resource addresses consistently regardless of their syntactic variation. In addition to patching, administrators should review current access control configurations to ensure that no other filters suffer from similar single-path validation weaknesses. Implementing defense-in-depth strategies such as WAF rules that detect path traversal attempts or abnormal URL structures can provide an additional layer of protection during the transition period. Regular security audits focusing on how authentication and authorization modules handle non-canonical URLs are essential to prevent future occurrences of this class of access control bypass vulnerabilities in Sling-based applications.