Executive brief
Spring Framework applications that use FreeMarker templating may be vulnerable to path traversal attacks if a web controller returns a view name based on user input. An attacker could potentially access template files outside the intended directory, leading to information disclosure or execution of unintended templates. This affects multiple Spring Framework versions across the 5.2, 5.3, 6.0, 6.1, 6.2, and 7.0 release lines.
Technical details
This is a path traversal vulnerability in Spring Framework's FreeMarker integration through the SpringTemplateLoader component. The root cause is insufficient validation of view names returned by controllers when those names are derived from untrusted user input. An attacker can exploit this by crafting malicious input containing path traversal sequences (e.g., "../") to escape the configured template directory and access arbitrary FreeMarker template files on the filesystem. The vulnerability requires that FreeMarker is configured to use SpringTemplateLoader for template resolution and that a controller returns a view name influenced by user-controlled input. An attacker with network access to the affected application can exploit this to read sensitive template files or potentially trigger template processing of arbitrary files, depending on FreeMarker configuration.
Affected products
- Spring Spring Framework 5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, 7.0.0-7.0.8
Timeline
- 2026-08-27: disclosed