What happened
CVE-2026-59294: Spring AI's ResourceCacheService.getCacheName() appends a URI fragment verbatim into the cache filename without stripping path separators or '..' sequences before passing it to a File constructor, enabling arbitrary file write via path traversal. CVE-2026-59319: RedisChatMemoryRepository.findByMetadata() builds RediSearch tag/text queries from caller-supplied metadata without applying RediSearchUtil.escape(), unlike sibling methods in the same class, allowing query injection from user-controlled metadata values.
Why it matters
These allow an attacker to write arbitrary files onto the host running a Spring AI resource cache (potential RCE via file planting) or to inject RediSearch queries to expose or manipulate chat memory across conversations/tenants in Spring AI's Redis-backed memory store.
Attack vector
Crafted URI fragment written to cache file path; or user-controlled metadata values injected into RediSearch tag/text queries
Affected systems
Spring AI 1.0.0-1.0.9, 1.1.0-1.1.8, 2.0.0
Mitigation
Upgrade to Spring AI 2.0.1 or later