Log in Start free

Vulnerability · Published Aug 27, 2026 · Assigned by vmware

CVE-2026-47884Spring Framework Improper Path Limitation in XsltView

Critical 9.8

In plain English

A critical-severity path traversal in Spring Framework from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 50.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2026-47884
Debian:13libspring-javano fix listedDEBIAN-CVE-2026-47884
Debian:14libspring-javano fix listedDEBIAN-CVE-2026-47884
Mavenorg.springframework:spring-webmvcno fix listedGHSA-pc63-qcmh-9cmg
Mavenorg.springframework:spring-webmvcno fix listedGHSA-pc63-qcmh-9cmg
Mavenorg.springframework:spring-webmvc7.0.9GHSA-pc63-qcmh-9cmg
Mavenorg.springframework:spring-webmvcno fix listedGHSA-pc63-qcmh-9cmg
Mavenorg.springframework:spring-webmvcno fix listedGHSA-pc63-qcmh-9cmg
Mavenorg.springframework:spring-webmvcno fix listedGHSA-pc63-qcmh-9cmg
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2026-47884
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2026-47884

Affected products (as reported)

VendorProductVersions
Spring Spring Framework 7.0.0 – through 7.0.86.2.0 – through 6.2.196.1.0 – through 6.1.286.0.0 – through 6.0.305.3.0 – through 5.3.490 – through 5.2.25.RELEASE

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References