Log in Start free

Vulnerability · Published Aug 18, 2025 · Assigned by vmware

CVE-2025-41242CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

Medium 5.9

In plain English

A medium-severity path traversal in Spring Framework from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)2.1%top 18.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC

Official description

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2025-41242
Debian:13libspring-javano fix listedDEBIAN-CVE-2025-41242
Debian:14libspring-javano fix listedDEBIAN-CVE-2025-41242
Mavenorg.springframework:spring-webmvcno fix listedGHSA-r936-gwx5-v52f
Mavenorg.springframework:spring-webmvc6.2.10GHSA-r936-gwx5-v52f
Mavenorg.springframework:spring-webmvcno fix listedGHSA-r936-gwx5-v52f
Mavenorg.springframework:spring-webmvcno fix listedGHSA-r936-gwx5-v52f
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2025-41242
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2025-41242
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2025-41242

Affected products (as reported)

VendorProductVersions
VMware Spring Framework 6.2.x – before 6.2.106.1.x – before 6.1.225.3.x – before 5.3.44

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References