CVE-2026-41843
published 2026-06-09CVE-2026-41843: Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through…
PriorityP433medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
0.34%
26.4th percentile
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| log4j_2 | log4j | — | — |
| pki-core_10.6 | resteasy | — | — |
| pki-deps_10.6 | resteasy | — | — |
| redhat | resteasy | — | — |
| spring | spring_framework | >= 5.3.0 < 5.3.49 | 5.3.49 |
| spring | spring_framework | >= 6.1.0 < 6.1.28 | 6.1.28 |
| spring | spring_framework | >= 6.2.0 < 6.2.18.1 | 6.2.18.1 |
| spring | spring_framework | >= 7.0.0 < 7.0.7.1 | 7.0.7.1 |
| vmware | spring_framework | >= 5.3.0 < 5.3.49 | 5.3.49 |
| vmware | spring_framework | >= 6.1.0 < 6.1.28 | 6.1.28 |
| vmware | spring_framework | >= 6.2.0 < 6.2.18.1 | 6.2.18.1 |
| vmware | spring_framework | >= 7.0.0 < 7.0.7.1 | 7.0.7.1 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.
ghsa_unreviewed·2026-06-09
CVE-2026-41843 [MEDIUM] CWE-22 Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
Red Hat
spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal
vendor_redhat·2026-06-09·CVSS 5.9
CVE-2026-41843 [MEDIUM] CWE-22 spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal
spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
A flaw was found in Spring Framework. Specifically, Spring MVC and WebFlux applications are vulnerable to a Path Traversal attack. This vulnerability allows a remote attacker to access sensitive files or directories on the server by manipulating requests for static resources. The successful exploitation of this flaw could lead to unauthorized information disclosure.
Statement: This Moderate impact flaw in Spring Framework's MVC and WebFlux components allows a remote at
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-41843 resteasy: Spring Framework: Information Disclosure via Path Traversal [fedora-all]
bugzilla·2026-06-12·CVSS 5.9
CVE-2026-41843 [MEDIUM] CVE-2026-41843 resteasy: Spring Framework: Information Disclosure via Path Traversal [fedora-all]
CVE-2026-41843 resteasy: Spring Framework: Information Disclosure via Path Traversal [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41843 log4j: Spring Framework: Information Disclosure via Path Traversal [fedora-all]
bugzilla·2026-06-12·CVSS 5.9
CVE-2026-41843 [MEDIUM] CVE-2026-41843 log4j: Spring Framework: Information Disclosure via Path Traversal [fedora-all]
CVE-2026-41843 log4j: Spring Framework: Information Disclosure via Path Traversal [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41843 spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal
bugzilla·2026-06-09·CVSS 5.9
CVE-2026-41843 [MEDIUM] CVE-2026-41843 spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal
CVE-2026-41843 spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal
Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.
Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
2026-06-09
Published