Executive brief
Spring Cloud Config, a tool used to manage centralized configuration for distributed applications, contains a security flaw that allows unauthorized access to files. By sending a specially crafted web request, an attacker can bypass security restrictions to view or download sensitive text and binary files from the server's file system. This could lead to the exposure of credentials, proprietary code, or other confidential configuration data.
Technical details
A directory traversal vulnerability exists in the spring-cloud-config-server module of Spring Cloud Config. The flaw is caused by improper validation of user-supplied input in specially crafted URLs, allowing an unauthenticated remote attacker to navigate outside the intended configuration directories. By exploiting this, an attacker can retrieve arbitrary text or binary files from the host file system. The vulnerability affects multiple major versions, and users are advised to upgrade to versions 3.1.14, 4.1.10, 4.2.7, 4.3.3, or 5.0.3 depending on their current release branch.
Affected products
- VMware Spring Cloud Config 3.1.0 to 3.1.13, 4.1.0 to 4.1.9, 4.2.0 to 4.2.6, 4.3.0 to 4.3.2, 5.0.0 to 5.0.2
Timeline
- 2026-05-07: disclosed: Initial vulnerability report and publication
- 2026-05-07: advisory: VMware and Red Hat published security advisories