CVE-2026-40985: VMware Spring Web Flow EL injection in WebFlowELExpressionParser

CVE-2026-40985 · Severity: medium · CVSS 6.4 · Published 2026-06-11

Spring Web Flow is a framework used to build web applications with complex navigation flows. Applications that configure the WebFlowELExpressionParser component are vulnerable to expression language injection attacks through malicious Unified EL expressions. An attacker with low privileges and user interaction could execute arbitrary code, potentially leading to unauthorized data access or modification.

Technologies: org.springframework.webflow:spring-webflow (Maven). Vendors: Maven, VMware.

Quick answers

Is CVE-2026-40985 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40985 being exploited in the wild.
How severe is CVE-2026-40985?
Medium severity, with a CVSS score of 6.4, published 11 June 2026.
Which products and versions are affected?
org.springframework.webflow:spring-webflow (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.1; VMware Spring Web Flow 4.0.0, 3.0.0 - 3.0.1, 2.5.0 - 2.5.1.
Is there a fix for CVE-2026-40985?
Yes. org.springframework.webflow:spring-webflow (Maven): upgrade to 4.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40985 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40985?
Check whether you run org.springframework.webflow:spring-webflow (Maven) or VMware Spring Web Flow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.webflow:spring-webflow (Maven): upgrade to 4.0.1 or later
    # set org.springframework.webflow:spring-webflow to 4.0.1 in your pom.xml or build.gradle

Technical details

The vulnerability is an expression language injection flaw (CWE-917) in the WebFlowELExpressionParser component of Spring Web Flow. The root cause is improper neutralization of special elements in Unified EL expressions, allowing attackers to inject malicious EL statements. The attack requires network access, low privileges, and user interaction. An attacker can achieve high confidentiality and integrity impact by executing arbitrary expressions within the context of the application. Patches are available: version 4.0.1 for 4.0.0; version 3.0.2 for 3.0.x; 2.5.x line has no official patch.

Affected products

  • Pivotal Software Spring Web Flow 4.0.0
  • Pivotal Software Spring Web Flow 3.0.0 through 3.0.1
  • Pivotal Software Spring Web Flow 2.5.0 through 2.5.1

Identifiers

  • CVE-2026-40985
  • GHSA-9ggw-87m9-9gfc

Timeline

  • 2026-06-11: disclosed: Vulnerability disclosed on GitHub Advisory Database
  • 2026-08-18: advisory: GitHub security advisory reviewed and finalized

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.