Path traversal in Spring Integration - CVE-2026-47862
Published: August 28, 2026
Vulnerability identifier: #VU146199
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47862
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to write a .zip archive to an arbitrary filesystem path outside the configured workDirectory.
The vulnerability exists due to improper input validation in ZipTransformer when using the file_name message header to build the workDirectory path. A remote user can set a specially crafted file_name header on a message to write a .zip archive to an arbitrary filesystem path outside the configured workDirectory.
The issue applies when ZipTransformer is used with ZipResultType.FILE, which is the default behavior.
Affected software
Spring Integration
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-47862
Install security update from vendor's website.
Spring Integration - addressed in versions 6.4.13, 6.5.11, 7.0.5.1, 7.0.6, 7.1.0.1, 7.1.1
Library Support for Spring - update to 3.5.19
Library Support for Spring - update to 3.5.19