CVE-2025-41242: Path Traversal Vulnerability in Spring Web MVC
Summary
CVE-2025-41242: Spring Framework MVC Applications Path Traversal Vulnerability. Affects org.springframework:spring-webmvc across 4 version ranges.
>= 5.3.0, <= 5.3.43
>= 6.0.0, <= 6.0.29
>= 6.1.0, <= 6.1.21
>= 6.2.0, < 6.2.10
Fixed in 6.2.10. How to fix ↓
Also tracked for
- libspring-java · Debian:11
The same CVE-2025-41242 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Web MVC is a part of the Spring Framework, designed to facilitate the development of web applications in Java. It provides a comprehensive model-view-controller architecture, enabling developers to create flexible and maintainable web applications. However, certain configurations and deployments can expose applications to vulnerabilities, such as path traversal, particularly when deployed on non-compliant Servlet containers.
Vulnerability Detail
The vulnerability arises from a path traversal issue in Spring Framework MVC applications when deployed on non-compliant Servlet containers. This occurs if the application is packaged as a WAR file or uses an embedded Servlet container that fails to reject suspicious URI sequences. If exploited, this vulnerability could allow attackers to access sensitive files on the server, leading to potential data breaches or unauthorized access.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.2.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your Servlet container is configured to reject suspicious URI sequences. Additionally, verify that your application is not serving static resources in a way that exposes it to path traversal attacks. Regularly review your security configurations to maintain compliance with best practices.
Conclusion
The CVE-2025-41242 vulnerability in Spring Web MVC poses a significant risk to applications deployed on non-compliant Servlet containers. It is crucial to upgrade to the patched version and implement recommended security practices to mitigate potential threats.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
A path traversal vulnerability allows an attacker to access files and directories outside the intended directory structure of an application, potentially exposing sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply analyzing your pom.xml file, you can check for vulnerabilities without needing to access the code.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files, potentially resulting in data breaches and compromising the security of your application.
Yes, as long as the default security features are not disabled in the configuration, applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable to this issue.
The CVSS score for this vulnerability is 5.9, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
