medium5.9
CVE-2026-41843
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.
Impact
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework:spring-webmvc | >= 7.0.0, <= 7.0.7 | 7.0.8 |
| maven | org.springframework:spring-webflux | >= 7.0.0, <= 7.0.7 | 7.0.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Framework | from 5.3.0 before 5.3.49 from 6.1.0 before 6.1.28 from 6.2.0 before 6.2.18.1 from 7.0.0 before 7.0.7.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-72pg-x5f8-j25j
- https://nvd.nist.gov/vuln/detail/CVE-2026-41843
- https://spring.io/security/cve-2026-41843
- https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19
- https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8