CVE-2026-47862: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Spring Spring Integration

The vulnerability CVE-2026-47862 in Spring Integration arises from improper limitation of a pathname to a restricted directory (CWE-22). When an attacker can set the file_name header on a message handled by the ZipTransformer with ZipResultType.FILE (default), the resulting .zip archive can be written to an arbitrary filesystem path outside the configured workDirectory. This allows potential unauthorized file writes outside the intended directory scope. The affected versions are Spring Integration 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The CVSS v3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and low confidentiality and integrity impact, no availability impact. No vendor advisory or patch information is provided, and no known exploits in the wild have been reported.

An attacker with the ability to set the file_name header on messages processed by the vulnerable ZipTransformer can cause arbitrary file writes outside the intended working directory. This could lead to unauthorized modification or creation of files on the filesystem, potentially impacting confidentiality and integrity. The impact is rated medium severity with a CVSS score of 5.4. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted messages that allow control over the file_name header in ZipTransformer with ZipResultType.FILE. Consider restricting or validating the file_name header input to prevent path traversal. Monitor vendor channels for updates and patches.