EUVD-2026-36202
GHSA-792x-6vq6-j8r9
Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Attacker must control the remote server the client is configured to trust (PR:H, AC:H, UI:R); arbitrary file write yields high integrity and availability impact with scope change beyond the app sandbox, no direct confidentiality loss.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Lifecycle Timeline
2DescriptionCVE.org
A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.
Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.
Articles & Coverage 2
AnalysisAI
Path traversal in Spring Integration's FTP/SFTP/SMB inbound adapters allows a malicious or compromised remote file server to write attacker-controlled files outside the configured local directory on any client polling it, affecting versions 5.5.0-5.5.20, 6.3.0-6.3.14, 6.4.0-6.4.11, 6.5.0-6.5.8, and 7.0.0-7.0.4. The flaw inverts the usual trust model - the file-transfer client trusts the server's filename, enabling overwrite of arbitrary host files such as configuration, cron, or application JARs, which can escalate to code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable application must use Spring Integration's FTP, SFTP, or SMB inbound channel adapter (or the underlying remote-file synchronizer) and must poll a file server that is either attacker-controlled or has been compromised - the attacker's leverage is the ability to choose remote filenames returned in directory listings or transfers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed but lean serious for organizations integrating with third-party file servers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An organization configures a Spring Integration SFTP inbound adapter to pull invoices nightly from a partner's SFTP server; the partner is compromised (or the partner is malicious from the outset) and serves a file whose remote name is '../../../../opt/app/config/application.properties' containing attacker-supplied JDBC and credential overrides. On the next poll, Spring Integration writes the file to the absolute path, and the next application restart picks up the malicious configuration, leading to credential theft or redirected traffic. … |
| Remediation | Patch available per vendor advisory at https://spring.io/security/cve-2026-40987; upgrade to the fixed maintenance release in your branch (5.5.x, 6.3.x, 6.4.x, 6.5.x, or 7.0.x past the affected ceiling listed above) as the primary fix, since the framework must reject traversal sequences and absolute paths in remote filenames. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running affected Spring Integration versions (5.5.0-5.5.20, 6.3.0-6.3.14, 6.4.0-6.4.11, 6.5.0-6.5.8, 7.0.0-7.0.4) and which use FTP/SFTP/SMB inbound adapters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Local denial of service in Android's PackageInstaller subsystem stems from a logic error in PackageInstallerSession.tran
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated at
NoSQL/query injection in Spring AI Vector Stores (1.0.0-1.0.8 and 1.1.0-1.1.7) allows remote unauthenticated attackers t
Origin validation failure in Spring Cloud Gateway (WebMVC and WebFlux Server variants) allows remote attackers to spoof
Server-Side Request Forgery in Spring Web Services (versions 3.1.0-3.1.8, 4.0.0-4.0.18, 4.1.0-4.1.3, and 5.0.0-5.0.1) al
Share
External POC / Exploit Code
Leaving vuln.today