Spring Cloud Config server modules prior to versions 3.1.14, 4.1.10, 4.2.7, 4.3.3, and 5.0.3 allow an attacker to perform directory traversal via crafted URLs, leading to arbitrary file disclosure. This improper limitation of pathname to a restricted directory (CWE-22) can expose sensitive configuration or system files. The vulnerability is rated critical with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Red Hat has published an advisory confirming the issue and the availability of fixed versions.

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files on the server hosting the Spring Cloud Config service. This can lead to disclosure of sensitive configuration data or other critical files, impacting confidentiality and integrity. There is no indication of availability impact. The vulnerability is critical due to the ease of exploitation and high confidentiality and integrity impact.

Fixed versions are available and should be applied: upgrade to 3.1.14 or later for 3.1.x, 4.1.10 or later for 4.1.x, 4.2.7 or later for 4.2.x, 4.3.3 or later for 4.3.x, and 5.0.3 or later for 5.0.x. The Red Hat advisory confirms these fixed versions. No other mitigations or temporary workarounds are indicated. Users should prioritize upgrading to the fixed releases to remediate this vulnerability.