description: Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.
problem types: Information Disclosure
affected:
{
product: Apache Tapestry
vendor: Apache
versions:
status: affected, version: Apache Tapestry 5.4.0 to 5.4.4
}