CVEvulnerability

CVE-2026-22737

5.9 MEDIUM Published 2026-03-20 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-03-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22

Description

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Affected configurations

• vmware spring framework (< 5.3.47) • vmware spring framework (>= 6.1.0 < 6.1.26) • vmware spring framework (>= 6.2.0 < 6.2.17) • vmware spring framework (>= 7.0.0 < 7.0.6)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References