This vulnerability (CWE-22) in Spring Integration permits an attacker controlling an FTP, SFTP, or SMB server to write files anywhere on the client filesystem, bypassing the intended directory restrictions. The affected versions include Spring Integration 5.5.0 through 5.5.20, 6.3.0 through 6.3.14, 6.4.0 through 6.4.11, 6.5.0 through 6.5.8, and 7.0.0 through 7.0.4. The CVSS 3.1 score of 7.1 reflects a network attack vector requiring low privileges and user interaction, with partial confidentiality impact, high integrity impact, and low availability impact. No official patch or remediation level is indicated in the available data.

An attacker controlling a malicious or compromised FTP/SFTP/SMB server can exploit this vulnerability to write arbitrary files outside the configured local directory on the client system. This can lead to unauthorized modification of files, potentially compromising system integrity and confidentiality. The impact includes partial loss of confidentiality, high loss of integrity, and low loss of availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid connecting to untrusted or potentially compromised FTP/SFTP/SMB servers. Monitor vendor communications for updates on patches or official mitigations.