Path traversal in Spring Framework - CVE-2026-59280
Published: August 31, 2026
Vulnerability identifier: #VU146381
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59280
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to path traversal in SpringTemplateLoader when resolving a view name derived from untrusted input. A remote attacker can supply a crafted view name containing backslash sequences to disclose sensitive information.
Only applications that return a view name derived from untrusted input and use FreeMarker configured with SpringTemplateLoader are vulnerable.
Affected software
Spring Framework
Library Support for Spring
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version
Library Support for Spring
OpenPages for IBM Cloud Pak for Data
OpenPages Cloud pak for data service version
How to mitigate CVE-2026-59280
Install security update from vendor's website.
Spring Framework - addressed in versions 5.2.26, 5.3.50, 6.0.31, 6.1.29, 6.2.20, 7.0.8.1, 7.0.9
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0
Library Support for Spring - update to 3.5.19
OpenPages for IBM Cloud Pak for Data - addressed in versions 5.3.1 Patch 16, 5.4.0
OpenPages Cloud pak for data service version - addressed in versions 9.6.7, 10.0.0