Medium

Spring Framework Improper Path Limitation with Script View Templates

Disclosed: 20.03.2026
Updated: 11.10.2026 13:20

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	org.springframework:spring-webflux	>= 7.0.0-M1, < 7.0.6, >= 6.2.0, < 6.2.17, >= 6.0.0, <= 6.1.21, >= 5.3.0, <= 5.3.39	7.0.6, 6.2.17
Java / Kotlin (Maven)	org.springframework:spring-webmvc	>= 7.0.0-M1, < 7.0.6, >= 6.2.0, < 6.2.17, >= 6.0.0, <= 6.1.21, >= 5.3.0, <= 5.3.39	7.0.6, 6.2.17

References

CVSS score 5.9/10

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-22
Platform: Java / Kotlin (Maven)
Package: org.springframework:spring-webflux, org.springframework:spring-webmvc
Disclosed: 20.03.2026
Updated: 11.10.2026 13:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-4773-3jfm-qmx3 - CC BY 4.0

Vulnerability history: org.springframework:spring-webflux

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (20) in the archive

Total entries: 20
First → latest: 01.2020 08.2026
Without a fix: 1
Exploited in attacks: 1

Severity breakdown

Critical 3
High 4
Medium 11
Low 2

Disclosures per year

2020: 2
2021: 0
2022: 1
2023: 0
2024: 2
2025: 0
2026: 15

27.08.2026

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

Critical · 9.8 CVE-2026-47892 >= 5.2.5.RELEASE, <= 5.2.25.RELEASE, >= 5.3.0, <= 5.3.49, >= 6.0.0, <= 6.0.30, >= 6.1.0, <= 6.1.28, >= 6.2.0, <= 6.2.19, >= 7.0.0, < 7.0.9 7.0.9
27.08.2026

Spring Framework Server Sent Event stream corruption while rendering fragments

Critical · 9.8 CVE-2026-47890 >= 6.2.0, <= 6.2.19, >= 7.0.0, < 7.0.9 7.0.9
09.06.2026

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

High · 7.5 CVE-2026-41842 >= 7.0.0, < 7.0.8, >= 6.2.0, < 6.2.19, >= 6.1.0, <= 6.1.21, <= 5.3.39 7.0.8, 6.2.19
20.03.2026

Spring Framework Improper Path Limitation with Script View Templates this entry

Medium · 5.9 CVE-2026-22737 >= 7.0.0-M1, < 7.0.6, >= 6.2.0, < 6.2.17, >= 6.0.0, <= 6.1.21, >= 5.3.0, <= 5.3.39 7.0.6, 6.2.17
19.12.2024

Spring Framework Path Traversal vulnerability

High · 7.5 CVE-2024-38819 >= 6.1.0, < 6.1.14, <= 5.3.40, >= 6.0.0, <= 6.0.24 6.1.14
13.09.2024

Path traversal vulnerability in functional web frameworks

High · 7.5 CVE-2024-38816 >= 6.1.0, < 6.1.13, >= 6.0.0, <= 6.0.23, >= 5.3.0, <= 5.3.39 6.1.13
31.03.2022

Remote Code Execution in Spring Framework

Critical · 9.8 Exploited in attacks CVE-2022-22965 < 5.2.20.RELEASE, >= 5.3.0, < 5.3.18 5.2.20.RELEASE, 5.3.18
21.01.2020

RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

High · 7.5 CVE-2020-5398 >= 5.2.0.RELEASE, < 5.2.3.RELEASE, >= 5.1.0.RELEASE, < 5.1.13.RELEASE, >= 5.0.0.RELEASE, < 5.0.16.RELEASE 5.2.3.RELEASE, 5.1.13.RELEASE, 5.0.16.RELEASE

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application