Vulnerability · Published Jun 11, 2026 · Assigned by vmware
CVE-2026-40987Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization
High 7.1
In plain English
A high-severity path traversal in Spring Integration from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.integration:spring-integration-file | 7.0.5 | GHSA-792x-6vq6-j8r9 |
| Maven | org.springframework.integration:spring-integration-file | 6.5.9 | GHSA-792x-6vq6-j8r9 |
| Maven | org.springframework.integration:spring-integration-file | no fix listed | GHSA-792x-6vq6-j8r9 |
| Maven | org.springframework.integration:spring-integration-file | no fix listed | GHSA-792x-6vq6-j8r9 |
| Maven | org.springframework.integration:spring-integration-file | no fix listed | GHSA-792x-6vq6-j8r9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Integration | 7.0.0 – before 7.0.4.16.5.0 – before 6.5.8.16.4.0 – before 6.4.126.3.0 – before 6.3.155.5.0 – before 5.5.21 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L