Log in Start free

Vulnerability · Published Mar 19, 2026 · Assigned by vmware

CVE-2026-22737Spring Framework Improper Path Limitation with Script View Templates

Medium 5.9

In plain English

A medium-severity path traversal in Spring Framework from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.4%top 64.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2026-22737
Debian:13libspring-javano fix listedDEBIAN-CVE-2026-22737
Debian:14libspring-javano fix listedDEBIAN-CVE-2026-22737
Mavenorg.springframework:spring-webfluxno fix listedGHSA-4773-3jfm-qmx3
Mavenorg.springframework:spring-webflux7.0.6GHSA-4773-3jfm-qmx3
Mavenorg.springframework:spring-webflux6.2.17GHSA-4773-3jfm-qmx3
Mavenorg.springframework:spring-webfluxno fix listedGHSA-4773-3jfm-qmx3
Mavenorg.springframework:spring-webmvc7.0.6GHSA-4773-3jfm-qmx3
Mavenorg.springframework:spring-webmvc6.2.17GHSA-4773-3jfm-qmx3
Mavenorg.springframework:spring-webmvcno fix listedGHSA-4773-3jfm-qmx3
Mavenorg.springframework:spring-webmvcno fix listedGHSA-4773-3jfm-qmx3
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2026-22737
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2026-22737
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2026-22737

Affected products (as reported)

VendorProductVersions
Spring Spring Framework 7.0.0 – through 7.0.56.2.0 – through 6.2.166.1.0 – through 6.1.255.3.0 – through 5.3.46

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References