This vulnerability (CVE-2026-40987) in Spring Integration allows an attacker controlling an FTP/SFTP/SMB server to write files anywhere on the client filesystem, bypassing the configured local-directory restrictions. The flaw is due to improper limitation of pathname to a restricted directory (CWE-22), enabling path traversal attacks. Affected versions include Spring Integration 5.5.0 through 5.5.20, 6.3.0 through 6.3.14, 6.4.0 through 6.4.11, 6.5.0 through 6.5.8, and 7.0.0 through 7.0.4. The CVSS 3.1 base score is 7.1, reflecting high severity with network attack vector, high impact on integrity, and low privileges required with user interaction.

An attacker who controls or compromises an FTP/SFTP/SMB server can exploit this vulnerability to write arbitrary files anywhere on the client filesystem, outside the intended local directory. This can lead to integrity violations and potential local system compromise or persistent malware installation. The attack requires user interaction and low privileges but can have significant impact due to the ability to place files arbitrarily.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a fix is released, users should exercise caution when connecting to untrusted or potentially compromised FTP/SFTP/SMB servers and consider restricting or monitoring file transfer operations. Follow vendor advisories for updates on remediation.