Is CVE-2026-47862 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47862 being exploited in the wild.

How severe is CVE-2026-47862?

Medium severity, with a CVSS score of 5.4, published 27 August 2026.

Which products and versions are affected?

Spring Integration 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, 7.1.0.

Is there a fix for CVE-2026-47862?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47862 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47862?

Check whether you run Spring Integration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47862: Spring Integration path traversal in ZipTransformer

CVE-2026-47862 · Severity: medium · CVSS 5.4 · Published 2026-08-27

Spring Integration's ZipTransformer component, a widely-used library for message processing, contains a path traversal vulnerability that allows an attacker to write ZIP archives to arbitrary locations on the filesystem. An attacker who can control the file_name header can bypass directory restrictions and write files outside the intended work directory, potentially compromising system integrity or enabling further attacks like code execution.

Technologies: Spring Integration. Vendors: Spring.

Quick answers

Is CVE-2026-47862 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47862 being exploited in the wild.
How severe is CVE-2026-47862?: Medium severity, with a CVSS score of 5.4, published 27 August 2026.
Which products and versions are affected?: Spring Integration 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, 7.1.0.
Is there a fix for CVE-2026-47862?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47862 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47862?: Check whether you run Spring Integration at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ZipTransformer component in Spring Integration fails to properly validate the file_name header when ZipResultType.FILE is configured (the default setting). This allows a path traversal attack via directory traversal sequences (e.g., ../ or absolute paths) in the file_name header. An attacker who can inject or control message headers reaching the ZipTransformer can cause the resulting .zip archive to be written outside the configured workDirectory. No authentication is required—the vulnerability is reachable to any attacker who can send a crafted message to the affected transformer. Patches are available for affected versions.

Affected products

Spring Integration 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, 7.1.0

Timeline

2026-08-27: disclosed

References

https://spring.io/security/cve-2026-47862

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.