This vulnerability arises from improper neutralization of special elements in Unified Expression Language (EL) statements within Spring Web Flow's WebFlowELExpressionParser. Applications that configure this parser are vulnerable to injection of malicious EL expressions, potentially leading to high confidentiality and integrity impacts. The affected versions explicitly include Spring Web Flow 4.0.0, 3.0.0 to 3.0.1, and 2.5.0 to 2.5.1. No official remediation or patch information is provided in the available data, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with low privileges and requiring user interaction to execute malicious Unified EL expressions, resulting in high confidentiality and integrity impact on the affected application. Availability impact is not indicated. The attack complexity is high, and the vulnerability requires network access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid configuring the WebFlowELExpressionParser with untrusted input or disable expression evaluation where possible. Monitor vendor channels for updates and apply patches promptly once released.