CVE-2026-47894: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Spring Spring Cloud Config

The vulnerability identified as CVE-2026-47894 involves improper limitation of a pathname to a restricted directory (CWE-22) in Spring Cloud Config Server's native environment repository. This flaw allows an attacker with high privileges to access configuration files outside the configured repository path, potentially exposing sensitive configuration data. The affected versions include Spring Cloud Config 3.1.14 and earlier, 4.0.0 through 4.2.8, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.4. No official fix or patch has been documented as of the publication date.

An attacker with high privileges can exploit this vulnerability to read configuration files outside the intended repository path, leading to exposure of sensitive configuration information. The vulnerability does not impact integrity or availability but has a high confidentiality impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor vendor communications for updates. Until a fix is available, restrict access to the Spring Cloud Config Server and limit privileges to trusted users to reduce risk.