Media

Spring Framework MVC Applications Path Traversal Vulnerability

Publicada: 18.08.2025
Actualizado: 11.10.2026 13:20

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

the application is deployed as a WAR or with an embedded Servlet container
the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization
the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling

We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Java / Kotlin (Maven)	org.springframework:spring-webmvc	>= 6.2.0, < 6.2.10, >= 6.1.0, <= 6.1.21, >= 6.0.0, <= 6.0.29, >= 5.3.0, <= 5.3.43	6.2.10

Referencias

Puntuación CVSS 5.9/10

Vector CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Debilidad (CWE): CWE-22
Plataforma: Java / Kotlin (Maven)
Paquete: org.springframework:spring-webmvc
Publicada: 18.08.2025
Actualizado: 11.10.2026 13:20

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-r936-gwx5-v52f - CC BY 4.0

Historial de vulnerabilidades: org.springframework:spring-webmvc

Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (27) en el archivo

Entradas en total: 27
Primera → última: 10.2018 08.2026
Sin corrección: 0
Explotada en ataques: 1

Distribución por gravedad

Crítica 4
Alta 8
Media 13
Baja 2

Divulgaciones por año

2018: 1
2019: 0
2020: 2
2021: 0
2022: 5
2023: 2
2024: 3
2025: 1
2026: 13

27.08.2026

Spring Framework Server Sent Event stream corruption while rendering fragments

Crítica · 9.8 CVE-2026-47890 >= 6.2.0, <= 6.2.19, >= 7.0.0, < 7.0.9 7.0.9
27.08.2026

Spring Framework Improper Path Limitation in XsltView

Crítica · 9.8 CVE-2026-47884 <= 5.2.25.RELEASE, >= 5.3.0, <= 5.3.49, >= 6.0.0, <= 6.0.30, >= 6.1.0, <= 6.1.28, >= 6.2.0, <= 6.2.19, >= 7.0.0, < 7.0.9 7.0.9
09.06.2026

Spring Framework Cross-site Scripting via JavaScriptUtils

Alta · 7.1 CVE-2026-41845 >= 7.0.0, < 7.0.8, >= 6.2.0, < 6.2.19, >= 6.1.0, <= 6.1.21, <= 5.3.39 7.0.8, 6.2.19
09.06.2026

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Alta · 7.5 CVE-2026-41842 >= 7.0.0, < 7.0.8, >= 6.2.0, < 6.2.19, >= 6.1.0, <= 6.1.21, <= 5.3.39 7.0.8, 6.2.19
18.08.2025

Spring Framework MVC Applications Path Traversal Vulnerability esta entrada

Media · 5.9 CVE-2025-41242 >= 6.2.0, < 6.2.10, >= 6.1.0, <= 6.1.21, >= 6.0.0, <= 6.0.29, >= 5.3.0, <= 5.3.43 6.2.10
19.12.2024

Spring Framework Path Traversal vulnerability

Alta · 7.5 CVE-2024-38819 >= 6.1.0, < 6.1.14, <= 5.3.40, >= 6.0.0, <= 6.0.24 6.1.14
13.09.2024

Path traversal vulnerability in functional web frameworks

Alta · 7.5 CVE-2024-38816 >= 6.1.0, < 6.1.13, >= 6.0.0, <= 6.0.23, >= 5.3.0, <= 5.3.39 6.1.13
28.11.2023

Spring Framework vulnerable to denial of service

Alta · 7.5 CVE-2023-34053 >= 6.0.0, < 6.0.14 6.0.14
28.03.2023

Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch

Crítica · 9.1 CVE-2023-20860 >= 6.0.0, < 6.0.7, >= 5.3.0, < 5.3.26 6.0.7, 5.3.26
13.05.2022

Improper Restriction of XML External Entity Reference in Spring Framework

Alta · 8.8 CVE-2014-0225 >= 4.0.0, < 4.0.5, >= 3.0.0, < 3.2.8 4.0.5, 3.2.8
31.03.2022

Remote Code Execution in Spring Framework

Crítica · 9.8 Explotada en ataques CVE-2022-22965 < 5.2.20.RELEASE, >= 5.3.0, < 5.3.18 5.2.20.RELEASE, 5.3.18
21.01.2020

RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

Alta · 7.5 CVE-2020-5398 >= 5.2.0.RELEASE, < 5.2.3.RELEASE, >= 5.1.0.RELEASE, < 5.1.13.RELEASE, >= 5.0.0.RELEASE, < 5.0.16.RELEASE 5.2.3.RELEASE, 5.1.13.RELEASE, 5.0.16.RELEASE
04.10.2018

Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized

Alta · 7.5 CVE-2016-9878 < 3.2.18, >= 4.2.0, < 4.2.9, >= 4.3.0, < 4.3.5 3.2.18, 4.2.9, 4.3.5

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación