Spring Framework Path Traversal Vulnerability in MVC and WebFlux Applications

A path traversal vulnerability has been identified in Spring Framework versions 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48. This vulnerability affects applications using Spring MVC or Spring WebFlux that serve static resources from the file system and have versioned resource support enabled. Under these conditions, an attacker could send malicious requests to access files outside the designated resource directories.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files outside the application's configured static resource locations, potentially exposing sensitive information or application data.

Remediation

Users should upgrade to Spring Framework versions 7.0.8, 6.2.19, 6.1.28, or 5.3.49, depending on their current version. Instructions for upgrading to these versions are available on the Spring Enterprise website.