# CVE-2026-41843: VMware Spring Framework path traversal in static resource resolution

Source: https://junglewise.ai/threats/cve-2026-41843-vmware-spring-framework-path-traversal-in-static-resource  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-41843 · Severity: medium · CVSS 5.9 · Published 2026-06-09

Spring Framework, a widely used tool for building Java applications, contains a vulnerability in how it handles requests for static files like images or stylesheets. An attacker could potentially bypass security restrictions to access sensitive files on the server that should not be publicly available. This could lead to the exposure of configuration files or other internal data, though the attack is complex to execute.

Technologies: [org.springframework:spring-webflux (Maven)](https://junglewise.ai/threats/technologies/org-springframework-spring-webflux), [org.springframework:spring-webmvc (Maven)](https://junglewise.ai/threats/technologies/org-springframework-spring-webmvc), [VMware Spring Framework](https://junglewise.ai/threats/technologies/spring-framework). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41843 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41843 being exploited in the wild.

**How severe is CVE-2026-41843?** Medium severity, with a CVSS score of 5.9, published 9 June 2026.

**Which products and versions are affected?** org.springframework:spring-webflux (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; org.springframework:spring-webmvc (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.8; VMware Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48, 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48.

**Is there a fix for CVE-2026-41843?** Yes. org.springframework:spring-webflux (Maven): upgrade to 7.0.8 or later; org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41843 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41843?** Check whether you run org.springframework:spring-webflux (Maven), org.springframework:spring-webmvc (Maven) or VMware Spring Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework:spring-webflux (Maven): upgrade to 7.0.8 or later

  ```sh
  # set org.springframework:spring-webflux to 7.0.8 in your pom.xml or build.gradle
  ```

- org.springframework:spring-webmvc (Maven): upgrade to 7.0.8 or later

  ```sh
  # set org.springframework:spring-webmvc to 7.0.8 in your pom.xml or build.gradle
  ```


## Technical details

A path traversal vulnerability (CWE-22) exists in Spring MVC and Spring WebFlux when applications are configured to resolve versioned static resources. The root cause is improper neutralization of special elements in the pathname during resource resolution. A remote, unauthenticated attacker can exploit this by sending specially crafted requests to access files outside of the intended directory. While the attack vector is network-based and requires no privileges, the complexity is rated as high. Patches are available in versions 7.0.8 and 6.2.19, with updates also recommended for the 6.1.x and 5.3.x branches.

## Affected products

- VMware Spring Framework 7.0.0 to 7.0.7, 6.2.0 to 6.2.18, 6.1.0 to 6.1.27, 5.3.0 to 5.3.48

## Identifiers

- CVE-2026-41843
- GHSA-72pg-x5f8-j25j

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-07-30: patched: Updated advisory with patch information

## References

- [https://spring.io/security/cve-2026-41843](https://spring.io/security/cve-2026-41843)
- [https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19](https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19)
- [https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8](https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8)

## Related threats

- [Spring Framework stream corruption in Server-Sent Events](https://junglewise.ai/threats/cve-2026-59313-spring-framework-stream-corruption-in-server-sent-events)
- [Spring Framework Server Sent Event stream corruption while rendering fragments](https://junglewise.ai/threats/cve-2026-47890-spring-framework-server-sent-event-stream-corruption-while)
- [Spring Framework information disclosure in WebSocket exception handling](https://junglewise.ai/threats/cve-2026-47893-spring-framework-information-disclosure-in-websocket-exception)
- [Spring Framework header predicate bypass in WebFlux functional endpoints](https://junglewise.ai/threats/cve-2026-47892-spring-framework-header-predicate-bypass-in-webflux-functional)
- [Spring Framework XML maxInMemorySize enforcement bypass](https://junglewise.ai/threats/cve-2026-47891-spring-framework-xml-maxinmemorysize-enforcement-bypass)