CVE-2014-3578: Improper Limitation of a Pathname to a Restricted Directory in Spring Framework
Summary
CVE-2014-3578: Improper Limitation of a Pathname to a Restricted Directory in Spring Framework. Affects org.springframework:spring-core across 2 version ranges.
>= 3.0.0, < 3.2.9
>= 4.0.0, < 4.0.5
Fixed in 3.2.9 or 4.0.5, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2014-3578 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The 'org.springframework:spring-core' package is a core component of the Spring Framework, providing essential functionality for dependency injection, resource management, and other key features. This vulnerability affects versions 3.x before 3.2.9 and 4.0 before 4.0.5 of the Spring Framework.
Vulnerability Detail
The vulnerability, identified as CVE-2014-3578, is a directory traversal vulnerability that allows remote attackers to read arbitrary files by exploiting a flaw in the Spring Framework's handling of URLs. By crafting a malicious URL, an attacker can bypass directory restrictions and access sensitive files on the server. This can lead to unauthorized disclosure of sensitive information and potential compromise of the affected system.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.2.93.2.9 -
>= 4.0.0, < 4.0.54.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a fixed version of the Spring Framework.
Conclusion
The directory traversal vulnerability in the Spring Framework (CVE-2014-3578) allows remote attackers to read arbitrary files on the server. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of the Spring Framework (3.2.9 or later for version 3.x, and 4.0.5 or later for version 4.0). For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-core →
FAQ
This vulnerability allows remote attackers to read arbitrary files on the server, potentially leading to unauthorized disclosure of sensitive information and compromise of the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
There are known exploits for this vulnerability, as it has been assigned a CVE identifier. Attackers can craft malicious URLs to exploit the directory traversal flaw and read arbitrary files on the server.
Yes, patches are available to fix this vulnerability. Users of the Spring Framework should upgrade to the fixed versions (3.2.9 or later for version 3.x, and 4.0.5 or later for version 4.0) to address the vulnerability.
You can find more information about this vulnerability, including its impact and technical details, in the GitHub Advisory Database entry at [link to the advisory].
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-core.
