Spring Web Flow CVE-2026-40985

Exploitation is gated on a non-default configuration: the target application must explicitly configure and use the WebFlowELExpressionParser component. Applications relying on Spring Web Flow's default expression handling are not affected. The CVSS vector (PR:L) confirms a low-privilege authenticated session within the application is required - unauthenticated external attackers cannot exploit this directly. Additionally, UI:R indicates a user interaction dependency, meaning exploitation cannot be fully automated against passive targets and requires a secondary triggering action. Limiting factors for defenders: the combination of non-default configuration (WebFlowELExpressionParser), mandatory authentication (PR:L), and required user interaction (UI:R) significantly narrows the exploitable population compared to a typical network-accessible unauthenticated flaw. Availability impact is absent (A:N), so denial-of-service scenarios are not in scope.

The NVD-assigned CVSS 6.4 Medium score reflects a meaningful real-world risk reduction from what the C:H/I:H impact pair would otherwise suggest. The AC:H metric confirms exploitation requires a specific non-default configuration - applications must explicitly instantiate WebFlowELExpressionParser rather than relying on default Spring Web Flow expression handling. PR:L indicates the attacker must hold at least a low-privilege authenticated session within the application, ruling out fully unauthenticated internet-scale scanning. UI:R introduces a further dependency on user interaction, which is unusual for a server-side injection and likely reflects a flow-driven processing model where a secondary user action (such as a form submission or flow transition by another party) must occur to evaluate the injected expression. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically. Neither KEV listing nor public POC has been identified, placing this in the 'monitor and patch' tier rather than emergency response. The primary realistic risk is to internal enterprise web applications built on Spring Web Flow that have explicitly opted into EL-based expression parsing - a narrower population than general Spring MVC users.

An authenticated low-privilege user targeting an application that explicitly configures WebFlowELExpressionParser crafts a malicious Unified EL expression (for example, one that traverses the EL context to access sensitive server-side objects or invoke privileged methods) and submits it through a web flow input field. After a required user interaction step completes - such as another party triggering a flow transition - the parser evaluates the injected expression server-side, potentially exposing sensitive data from the application context or modifying server-side state. No public proof-of-concept code has been identified to date.