Executive brief
Spring Framework's UrlFileNameViewController component contains an open redirect vulnerability when configured with specific settings. This allows attackers to trick users into being redirected to malicious external websites by crafting specially crafted URLs, potentially leading to phishing attacks, malware distribution, or credential harvesting without proper validation.
Technical details
The vulnerability exists in Spring Framework's UrlFileNameViewController when mapped with an end-of-path pattern and no configured prefix. The component fails to properly validate redirect destinations, allowing an attacker to inject arbitrary URLs that will be followed by unsuspecting users. This is a classic open redirect flaw where user-supplied input (filename/path parameters) is used directly in a redirect response without validation. The vulnerability requires that the application be configured in a specific way (end-of-path mapping without prefix) and is reachable over the network. Exploitation typically requires user interaction (clicking a malicious link). Patches have been released for affected versions.
Affected products
- Spring Framework 5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8
Timeline
- 2026-08-27: disclosed: CVE-2026-47887 published