CVE-2026-22737: Spring Framework Improper Path Limitation in Script View Templates
Summary
CVE-2026-22737: Spring Framework Improper Path Limitation with Script View Templates. Affects org.springframework:spring-webmvc across 4 version ranges.
>= 5.3.0, <= 5.3.39
>= 6.0.0, <= 6.1.21
>= 6.2.0, < 6.2.17
>= 7.0.0-M1, < 7.0.6
Fixed in 6.2.17 or 7.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Spring Framework is a powerful framework for building Java applications, particularly in web development. It provides comprehensive infrastructure support for developing Java applications. The framework includes modules such as Spring MVC and Spring WebFlux, which facilitate the creation of web applications. However, certain versions of these modules are vulnerable to improper path limitations when using Java scripting engine-enabled template views, potentially exposing sensitive file content.
Vulnerability Detail
The vulnerability arises from the use of Java scripting engines (like JRuby or Jython) in Spring MVC and Spring WebFlux applications. This can lead to unauthorized disclosure of content from files located outside the designated script template view directories. The affected versions of the Spring Framework range from 5.3.0 to 7.0.5, making it critical for users of these versions to address the issue promptly to prevent potential data leaks.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.2.0, < 6.2.176.2.17 -
>= 7.0.0-M1, < 7.0.67.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, restrict the use of Java scripting engines in your application until you can apply the patch. This can be done by configuring your application to disable script view templates or by ensuring that sensitive files are not accessible through the web application.
Conclusion
The CVE-2026-22737 vulnerability in the Spring Framework poses a risk of unauthorized file access through improper path limitations in script view templates. Users are advised to update to the latest patched versions to mitigate this risk. Temporary workarounds are available, but applying the patch is the best long-term solution.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
CVE-2026-22737 is a vulnerability in the Spring Framework that allows unauthorized access to files outside the configured script template view locations.
The affected versions include Spring Framework from 5.3.0 to 5.3.46, 6.1.0 to 6.1.25, 6.2.0 to 6.2.16, and 7.0.0 to 7.0.5.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.9, indicating a moderate level of risk.
If immediate updates are not possible, consider disabling Java scripting engines in your application as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
