Executive brief
Spring Framework, a widely used tool for building Java applications, contains a vulnerability in how it handles requests for static files like images or stylesheets. An attacker could potentially bypass security restrictions to access sensitive files on the server that should not be publicly available. This could lead to the exposure of configuration files or other internal data, though the attack is complex to execute.
Technical details
A path traversal vulnerability (CWE-22) exists in Spring MVC and Spring WebFlux when applications are configured to resolve versioned static resources. The root cause is improper neutralization of special elements in the pathname during resource resolution. A remote, unauthenticated attacker can exploit this by sending specially crafted requests to access files outside of the intended directory. While the attack vector is network-based and requires no privileges, the complexity is rated as high. Patches are available in versions 7.0.8 and 6.2.19, with updates also recommended for the 6.1.x and 5.3.x branches.
Affected products
- VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-07-30: patched: Updated advisory with patch information