CVE-2026-41843: Path Traversal Vulnerability in Spring MVC and WebFlux
Summary
CVE-2026-41843: Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux. Affects org.springframework:spring-webmvc across 4 version ranges.
< 5.3.39
>= 6.1.0, <= 6.1.21
>= 6.2.0, < 6.2.19
>= 7.0.0, < 7.0.8
Fixed in 5.3.39, 6.2.19 or 7.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring MVC and WebFlux are popular frameworks in the Spring ecosystem, designed for building web applications and RESTful services. They provide a comprehensive programming and configuration model, enabling developers to create robust applications with ease. However, certain versions of these frameworks are susceptible to a Path Traversal vulnerability, which can lead to unauthorized access to sensitive files on the server.
Vulnerability Detail
The vulnerability arises from improper handling of static resource paths in Spring MVC and WebFlux applications. Attackers can exploit this flaw by crafting malicious requests that traverse the directory structure, potentially gaining access to sensitive files outside the intended resource directory. This can lead to data exposure and compromise the security of the application. The affected versions include Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48, with a CVSS score of 5.9 indicating a moderate severity.
How To Fix
Latest published version: 7.1.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 5.3.395.3.39 -
>= 6.2.0, < 6.2.196.2.19 -
>= 7.0.0, < 7.0.87.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization for resource paths to mitigate the risk of Path Traversal attacks. Ensure that user inputs are properly validated to restrict access to legitimate resources only.
Conclusion
The Path Traversal vulnerability in Spring MVC and WebFlux poses a significant risk to applications using affected versions. It is crucial to update to the latest patched versions to safeguard against potential exploitation. Additionally, implementing input validation can serve as a temporary measure while upgrades are planned.
See every vulnerability recorded for org.springframework:spring-webmvc →
FAQ
A Path Traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory structure of the application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your pom.xml file, Vulert can help you determine if your application is vulnerable.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files, potentially exposing confidential information and compromising application security.
Yes, you can implement input validation and sanitization for resource paths to restrict access to legitimate resources and reduce the risk of exploitation.
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework:spring-webmvc.
