Path traversal in Spring Framework - CVE-2026-47884

Vulnerability identifier: #VU146217

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-47884

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper path limitation in XsltView when rendering views through a catch-all "/**" mapping without an explicitly specified view name. A remote attacker can send a specially crafted request to execute arbitrary code.

The issue can also lead to server-side request forgery.

Spring Framework
Library Support for Spring
OpenPages for IBM Cloud Pak for Data
Maximo Real Estate and Facilities Management (MREF)
OpenPages Cloud pak for data service version
IBM Sterling Control Center

Install security update from vendor's website.

Spring Framework - addressed in versions 5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
IBM Sterling Control Center - addressed in versions 6.3.1.0.12, 6.4.2.0.8
Maximo Real Estate and Facilities Management (MREF) - addressed in versions 9.1.16, 9.2.4
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0

• https://spring.io/security/cve-2026-47884

• Multiple vulnerabilities in Spring Framework
• Multiple vulnerabilities in IBM Library Support for Spring
• Multiple vulnerabilities in IBM Control Center
• Multiple vulnerabilities in IBM Maximo Application Suite - MREF
• Multiple vulnerabilities in IBM OpenPages for Cloud Pak for Data