Vulnerability · Published Mar 24, 2026 · Assigned by vmware
CVE-2026-22739Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
High 8.6
In plain English
A high-severity path traversal in Spring Cloud from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-config-server | 4.3.2 | GHSA-3qwq-q9vm-5j42 |
| Maven | org.springframework.cloud:spring-cloud-config-server | 5.0.2 | GHSA-3qwq-q9vm-5j42 |
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-3qwq-q9vm-5j42 |
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-3qwq-q9vm-5j42 |
| Maven | org.springframework.cloud:spring-cloud-config-server | no fix listed | GHSA-3qwq-q9vm-5j42 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Cloud | 3.1.x – before 3.1.134.1.x – before 4.1.94.2.x – before 4.2.34.3.x – before 4.3.25.0.x – before 5.0.2 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L