What is the CVSS score of CVE-2026-41843?

CVE-2026-41843 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41843?

Yes, a patch is available for CVE-2026-41843. Update the affected software to the latest version immediately.

Spring Framework CVE-2026-41843

EUVD-2026-35331 MEDIUM

Path Traversal (CWE-22)

2026-06-09 vmware

GHSA-72pg-x5f8-j25j

Path Traversal Java Spring Framework

5.9

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:25 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.springframework:spring-webflux (5 direct, 1 indirect)
21 maven packages depend on org.springframework:spring-webmvc (13 direct, 8 indirect)

Ecosystem-wide dependent count for version 7.0.0 and other introduced versions.

DescriptionCVE.org

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

AnalysisAI

Path traversal in Spring Framework's static resource resolution exposes arbitrary server files to unauthenticated remote attackers across both Spring MVC and Spring WebFlux stacks. Four major release lines - 5.3.x, 6.1.x, 6.2.x, and 7.0.x - are affected, making this a broad-surface issue for the Java ecosystem. The CVSS vector confirms unauthenticated network access with high confidentiality impact, though the AC:H designation indicates non-trivial exploit conditions; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where user-supplied path segments are insufficiently sanitized before being resolved against the static resource directory. Both the servlet-based Spring MVC stack and the reactive Spring WebFlux stack share this flaw in their resource-handling layer, suggesting the vulnerable code path exists in a common utility used by both frameworks. The CPE string cpe:2.3:a:spring:spring_framework:*:*:*:*:*:*:*:* confirms the affected artifact is the VMware/Broadcom-maintained Spring Framework Java library. The AC:H classification implies that exploitation may depend on specific URL encoding variations, OS-level path normalization behavior, or application-level configuration that prevents straightforward traversal - typical of path traversal bugs that require bypass of one or more canonicalization steps.

RemediationAI

Consult the VMware Spring security advisory at https://spring.io/security/cve-2026-41843 for confirmed fixed release versions, as the provided input data does not specify exact patched version numbers and none can be independently confirmed here. Based on the affected ranges, fixed versions logically follow as 7.0.8+, 6.2.19+, 6.1.28+, and 5.3.49+, but these are inferred - verify against the advisory before acting. As a compensating control while patching, disable Spring's static resource handler via ResourceHandlerRegistry if the application does not require framework-served static files; this eliminates the attack surface entirely but will break any feature depending on it. Alternatively, deploy a reverse proxy or WAF with path traversal normalization rules to reject requests containing traversal sequences before they reach the application - note that WAF bypass via alternate encodings is possible and this is a defense-in-depth measure, not a fix. Restricting the web application's OS-level file permissions so the Spring process cannot read outside the intended web root limits the blast radius of any successful traversal.