CVE-2026-22739: Spring Cloud Config Server Path Traversal Vulnerability Allows Arbitrary File Access
Summary
CVE-2026-22739: Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access. Affects org.springframework.cloud:spring-cloud-config-server across 5 version ranges.
< 3.1.10
>= 4.0.0, <= 4.1.7
>= 4.2.0, <= 4.2.4
>= 4.3.0, < 4.3.2
>= 5.0.0-M1, < 5.0.2
Fixed in 3.1.10, 4.3.2 or 5.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Cloud Config Server is a powerful tool that provides server-side and client-side support for externalized configuration in a distributed system. It allows applications to retrieve configuration from a variety of sources, including a native file system. However, this flexibility can lead to security vulnerabilities if not properly managed, particularly in how it handles user input for profile parameters.
Vulnerability Detail
The vulnerability arises from improper handling of the profile parameter in requests made to the Spring Cloud Config Server configured with a native file system backend. This flaw allows attackers to exploit path traversal techniques to access files outside the designated search directories. As a result, sensitive files may be exposed, leading to potential data breaches and unauthorized access to critical information.
How To Fix
Latest published version: 5.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.1.103.1.10 -
>= 4.3.0, < 4.3.24.3.2 -
>= 5.0.0-M1, < 5.0.25.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can restrict access to sensitive files by configuring the server to limit the directories from which files can be served. Additionally, validate and sanitize user input for the profile parameter to prevent path traversal attacks.
Conclusion
The CVE-2026-22739 vulnerability in Spring Cloud Config Server poses a significant risk due to its potential for arbitrary file access through path traversal. It is crucial for users to update to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for org.springframework.cloud:spring-cloud-config-server →
FAQ
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
Affected versions include Spring Cloud Config Server from 3.1.X before 3.1.13, 4.1.X before 4.1.9, 4.2.X before 4.2.3, 4.3.X before 4.3.2, and 5.0.X before 5.0.2.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files, potentially resulting in data breaches and loss of confidentiality.
Yes, you can implement input validation and restrict access to sensitive directories as a temporary measure until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.cloud:spring-cloud-config-server.
