CVE-2026-47887: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') in Spring Spring Framework

This vulnerability involves an open redirect (CWE-601) in Spring Framework's UrlFileNameViewController when it is mapped with an end-of-path and no prefix is configured. Affected versions include Spring Framework 5.2.25.RELEASE and earlier, 5.3.0 through 5.3.49, 6.0.0 through 6.0.30, 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. The flaw allows attackers to redirect users to untrusted external sites, potentially facilitating phishing or other social engineering attacks. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

The vulnerability allows attackers to craft URLs that redirect users to untrusted sites, which can be used for phishing or to trick users into interacting with malicious content. The CVSS score of 6.1 indicates a medium impact with low confidentiality and integrity impact and no availability impact. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using UrlFileNameViewController mapped with an end-of-path without a configured prefix or implement custom validation to prevent open redirects.