An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting… (CVE-2026-47862)

The vulnerability allows an attacker who can control the file_name header in messages processed by Spring Integration's ZipTransformer component (configured with ZipResultType.FILE) to write ZIP archives to arbitrary filesystem paths outside the configured working directory. This affects multiple versions of Spring Integration including 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12. The CVSS 3.1 base score is 5.4 (medium severity) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, and low impact on confidentiality and integrity with no availability impact.

An attacker with the ability to set the file_name header can cause arbitrary file write outside the intended directory, potentially leading to partial compromise of confidentiality and integrity of the system files. There is no indication of availability impact or elevated privileges required beyond low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or validate the file_name header input to prevent arbitrary path traversal. Monitor for updates from Spring Integration for official patches or mitigations.