← CVE Intelligence

CVE-2026-41843

Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux PUBLISHED

Description (CNA)

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Affected (CNA)

Vendor / productVersions
Spring / Spring Frameworkaffected 7.0.0 before 7.0.7.1; affected 6.2.0 before 6.2.18.1; affected 6.1.0 before 6.1.28; affected 5.3.0 before 5.3.49

CWE

CWE-22

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.