CVE-2016-9878: Pivotal Spring Framework Paths Directory Traversal Vulnerability
Summary
CVE-2016-9878: Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized. Affects org.springframework:spring-webmvc across 3 version ranges.
< 3.2.18
>= 4.2.0, < 4.2.9
>= 4.3.0, < 4.3.5
Fixed in 3.2.18, 4.2.9 or 4.3.5, depending on the release line you run. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2016-9878 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Pivotal Spring Framework is a popular open-source Java framework used for building enterprise-level applications. It provides a comprehensive programming and configuration model for modern Java-based enterprise applications. The framework includes various modules, such as spring-core, which provides core utilities and features for the Spring Framework. The spring-core module is widely used in Spring-based applications for its essential functionalities.
Vulnerability Detail
The Pivotal Spring Framework before versions 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5 is vulnerable to a directory traversal attack. This vulnerability arises from the improper sanitization of paths provided to the ResourceServlet. Attackers can exploit this vulnerability to traverse directories and access sensitive files outside the intended directory. This can lead to unauthorized access, information disclosure, and potential compromise of the application and its underlying system.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.2.183.2.18 -
>= 4.2.0, < 4.2.94.2.9 -
>= 4.3.0, < 4.3.54.3.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization mechanisms to ensure that user-supplied paths are properly sanitized and restricted to the intended directory. This can be achieved by validating and filtering user input to prevent any directory traversal characters or sequences. Additionally, access controls and permissions should be enforced to restrict access to sensitive files and directories.
Conclusion
The Pivotal Spring Framework is vulnerable to a directory traversal attack, allowing unauthorized access to sensitive files. To mitigate this vulnerability, it is crucial to upgrade to the patched versions of the framework or implement the recommended workarounds. Regularly monitoring for security updates and following secure coding practices are essential to protect applications from potential attacks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
This vulnerability allows attackers to access sensitive files outside the intended directory, potentially leading to unauthorized access, information disclosure, and compromise of the application and its underlying system.
No, only versions before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5 are affected. It is recommended to upgrade to the patched versions to mitigate the vulnerability.
While specific exploits for this vulnerability may exist, they have not been disclosed publicly. However, it is crucial to address this vulnerability promptly to prevent potential attacks.
Yes, this vulnerability can be exploited remotely by sending crafted requests to the affected application. It is important to apply the necessary patches or workarounds to mitigate the risk.
There is no specific evidence of active exploitation of this vulnerability at the moment. However, it is always recommended to stay updated with security patches and best practices to protect against potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
