CVE-2026-41843 is a CWE-22 path traversal vulnerability affecting Spring Framework's MVC and WebFlux modules. It arises from improper limitation of pathnames to restricted directories during static resource resolution. The affected versions include 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. The vulnerability allows remote attackers to read arbitrary files outside the intended resource directories, potentially exposing sensitive information. The CVSS 3.1 base score is 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation can lead to unauthorized disclosure of sensitive files outside the intended static resource directories in affected Spring Framework applications. This compromises confidentiality but does not affect integrity or availability. The attack requires network access and has high attack complexity, limiting ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to static resource endpoints, validating and sanitizing user-supplied paths, and applying web application firewall rules to detect and block path traversal attempts. Monitor vendor communications for updates on patches or official mitigations.