CVE catalog
CVE-2023-49735
tiles: CVE-2023-49735
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.34% · Oct 25, 2026
** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles. This issue affects Apache Tiles from version 2 onwards. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | tiles | sid | 3.0.7-6 | vulnerable |
| Debian | tiles | forky | 3.0.7-6 | vulnerable |
| Debian | tiles | trixie | 3.0.7-6 | vulnerable |
| Debian | tiles | bookworm | 3.0.7-5 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | tiles | source | sid | (unfixed) | unimportant | Not reported | [1057315] |
| Debian | tiles | source | forky | (unfixed) | unimportant | Not reported | [1057315] |
| Debian | tiles | source | trixie | (unfixed) | unimportant | Not reported | [1057315] |
| Debian | tiles | source | bookworm | (unfixed) | unimportant | Not reported | [1057315] |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.