This vulnerability (CVE-2026-40987) in Spring Integration involves improper limitation of a pathname to a restricted directory (CWE-22). An attacker controlling or compromising an FTP, SFTP, or SMB server can exploit this flaw to write files anywhere on the client filesystem, bypassing the intended local directory restrictions. This can result in unauthorized file creation or modification with attacker-controlled content. The affected versions include Spring Integration 7.0.0 through 7.0.4, 6.5.0 through 6.5.8, 6.4.0 through 6.4.11, 6.3.0 through 6.3.14, and 5.5.0 through 5.5.20. No official patch or remediation level is currently indicated in the available data.

Exploitation of this vulnerability allows an attacker to write arbitrary files outside the intended directory on the client system, potentially leading to unauthorized modification of files (high integrity impact), partial loss of confidentiality, and limited availability impact. This could facilitate further attacks or persistence on the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when connecting to untrusted FTP/SFTP/SMB servers and consider restricting or monitoring file transfer operations. Review vendor communications regularly for updates on patches or official mitigations.