CVE-2026-59280: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Spring Spring Framework

CVE-2026-59280 is a path traversal vulnerability (CWE-22) in Spring Framework's FreeMarker integration. When a controller returns a view name based on untrusted input and FreeMarker resolves templates via SpringTemplateLoader, an attacker may be able to traverse directories and access files outside the restricted template directory. This affects Spring Framework versions 5.2.25.RELEASE and earlier, 5.3.0 through 5.3.49, 6.0.0 through 6.0.30, 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. The CVSS v3.1 base score is 4.3 (medium severity), reflecting low confidentiality impact with no integrity or availability impact. No official patch or remediation level is currently provided.

An attacker with limited privileges (PR:L) can cause the application to load templates from arbitrary file system locations outside the intended directory, potentially exposing sensitive information. The impact is limited to confidentiality with no integrity or availability effects. The attack requires network access and no user interaction but has low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid returning view names derived from untrusted input or configure FreeMarker to restrict template resolution paths. Monitor vendor communications for updates on patches or official mitigations.