CVE-2026-47884: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Spring Spring Framework

This vulnerability arises from the use of XsltView in Spring MVC applications where a catch-all /** mapping triggers view rendering without an explicitly specified view name. This improper handling allows attackers to perform path traversal attacks (CWE-22), potentially leading to SSRF and RCE. Affected versions include Spring Framework 5.2.25.RELEASE and earlier, and all versions up to 7.0.8 in the 5.x, 6.x, and 7.x series as specified. The CVSS 3.1 score of 9.8 reflects the critical impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to remote code execution and server-side request forgery, compromising the confidentiality, integrity, and availability of affected systems running vulnerable Spring Framework versions. This poses a critical risk to applications using the vulnerable XsltView configuration with catch-all mappings that do not explicitly specify view names.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using /** mappings that result in view rendering without explicitly specifying the view name when using XsltView. Review application configurations to mitigate exposure to this vulnerability.