CVE-2014-3625: Improper Limitation of a Pathname to a Restricted Directory in Spring Framework
Summary
CVE-2014-3625: Improper Limitation of a Pathname to a Restricted Directory in Spring Framework. Affects org.springframework:spring-webmvc across 3 version ranges.
>= 3.0.4, < 3.2.12
>= 4.0.0, < 4.0.8
>= 4.1.0, < 4.1.2
Fixed in 3.2.12, 4.0.8 or 4.1.2, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2014-3625 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Pivotal Spring Framework is a popular open-source application framework for Java. It provides comprehensive infrastructure support for developing Java applications. The Spring Framework includes various modules, such as spring-webmvc, which is responsible for handling web requests and managing the Model-View-Controller (MVC) architecture. This vulnerability affects versions 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 of the spring-webmvc module.
Vulnerability Detail
The vulnerability in the Spring Framework is a directory traversal vulnerability. It allows remote attackers to read arbitrary files by exploiting unspecified vectors related to static resource handling. This means that an attacker can potentially access sensitive files on the server by manipulating the file path in a way that bypasses the intended restrictions. The exact details of the vectors and the specific files that can be accessed are not disclosed in the vulnerability report.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.4, < 3.2.123.2.12 -
>= 4.0.0, < 4.0.84.0.8 -
>= 4.1.0, < 4.1.24.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided in the vulnerability report. The recommended approach is to upgrade to a fixed version of the Spring Framework as mentioned in the 'how_to_fix' section.
Conclusion
The directory traversal vulnerability in the Spring Framework can be mitigated by upgrading to a fixed version of the framework. It is important to keep software dependencies up to date to ensure the security of your applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
The vulnerability allows remote attackers to read arbitrary files on the server, potentially exposing sensitive information.
No, only versions 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 of the spring-webmvc module are affected.
The vulnerability report does not provide details about known exploits.
Yes, remote attackers can exploit this vulnerability.
The vulnerability report does not mention a CVSS score.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
