Spring Cloud Config server modules prior to versions 3.1.14, 4.1.10, 4.2.7, 4.3.3, and 5.0.3 allow path traversal attacks (CWE-22) via specially crafted URLs. This vulnerability permits an attacker to access arbitrary text and binary files served by the config server, potentially exposing sensitive data. The CVSS 3.1 base score is 9.1 (critical) with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts. The vulnerability affects multiple release lines and requires upgrading to fixed versions to remediate. No vendor advisory text is provided to confirm patch status explicitly, but version upgrade recommendations imply official fixes.

Successful exploitation allows an unauthenticated attacker to read arbitrary files from the Spring Cloud Config server, leading to high confidentiality and integrity impact. There is no impact on availability. This could result in exposure of sensitive configuration data or other files accessible to the server process.

Upgrade affected Spring Cloud Config server instances to the fixed versions: 3.1.14 or later, 4.1.10 or later, 4.2.7 or later, 4.3.3 or later, or 5.0.3 or later. These upgrades address the path traversal vulnerability. Patch status is inferred from version upgrade guidance; check the official Spring vendor advisories for confirmation and detailed remediation instructions. No other mitigations are indicated.