Path traversal in Spring Framework - CVE-2026-22737

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU128372

Path traversal in Spring Framework - CVE-2026-22737

Published: April 28, 2026


Vulnerability identifier: #VU128372
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-22737
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper path limitation in script view templates when rendering views with Java scripting engine enabled and the view name is not explicitly specified. A remote attacker can send a specially crafted request to disclose sensitive information.

Exploitation requires a mapping for "/**" that results in view rendering.


Affected software

Spring Framework
Library Support for Spring
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
CICS Transaction Gateway for Multiplatforms
CICS Transaction Gateway Desktop Edition
MongoDB Enterprise Advanced with IBM
IBM Sterling Connect:Direct for Microsoft Windows

How to mitigate CVE-2026-22737

Install security update from vendor's website.

Spring Framework - addressed in versions 5.3.47, 6.1.26, 6.2.17, 7.0.6
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3.1 Patch 5
MongoDB Enterprise Advanced with IBM - update to 1.16.0
IBM Sterling Connect:Direct for Microsoft Windows - addressed in versions 6.3.0.6.45, 6.4.0.4.17

External References

Related Security Bulletins