Path traversal in Spring Cloud Config - CVE-2026-22739
Published: April 28, 2026
Vulnerability identifier: #VU128384
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-22739
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to access files outside of configured search directories.
The vulnerability exists due to improper limitation of a pathname to a restricted directory in the profile parameter handling in the Spring Cloud Config Server native file system backend when substituting the profile parameter from a request. A remote attacker can send a specially crafted request to access files outside of configured search directories.
Only configurations using the native file system backend are affected by this issue.
Affected software
Spring Cloud Config
How to mitigate CVE-2026-22739
Install security update from vendor's website.
Spring Cloud Config - addressed in versions 3.1.13, 4.1.9, 4.2.6, 4.3.2, 5.0.2