Threats Tagged 'ghsa-pc63-qcmh-9cmg'

CVE-2026-47884 is a critical path traversal vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE and earlier through 7.0.8. It arises from improper limitation of pathnames in the XsltView component of Spring MVC. Applications with a /** mapping that triggers view rendering without an explicitly specified view name are vulnerable. This flaw can lead to server-side request forgery (SSRF) and remote code execution (RCE). The vulnerability has a CVSS score of 9.8, indicating critical severity. No official patch or remediation guidance is currently available.