SB2026052218 - IBM Watson Speech Services Cartridge update for Spring MVC and WebFlux

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026052218

SB2026052218 - IBM Watson Speech Services Cartridge update for Spring MVC and WebFlux

Published: May 22, 2026

Security Bulletin ID SB2026052218
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Path traversal (CVE-ID: CVE-2026-22737)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper path limitation in script view templates when rendering views with Java scripting engine enabled and the view name is not explicitly specified. A remote attacker can send a specially crafted request to disclose sensitive information.

Exploitation requires a mapping for "/**" that results in view rendering.


Remediation

Install update from vendor's website.

References