What is the CVSS score of CVE-2026-41863?

CVE-2026-41863 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41863?

Yes, a patch is available for CVE-2026-41863. Update the affected software to the latest version immediately.

Spring AI CVE-2026-41863

EUVD-2026-31638 MEDIUM

Path Traversal (CWE-22)

2026-05-25 vmware

GHSA-cc4m-mp48-x7qg

Path Traversal Java Spring Ai

6.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:44 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 maven packages depend on org.springframework.ai:spring-ai-anthropic (2 direct, 2 indirect)

Ecosystem-wide dependent count for version 1.1.0.

DescriptionCVE.org

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.

Affected versions: Spring AI: 1.1.0 through 1.1.x

AnalysisAI

Path traversal in Spring AI 1.1.0-1.1.x allows authenticated remote attackers to write arbitrary files outside the intended target directory by exploiting unsanitized LLM-influenced filenames in the Anthropic Skills API file-write workflow. The root cause is Spring AI passing filenames derived from LLM output directly to Path.resolve() without input sanitization, enabling directory escape via traversal sequences. No public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile), though the high integrity impact (CVSS I:H) makes unauthorized file writes to restricted directories a meaningful concern in production deployments.

Technical ContextAI

Spring AI is a Java framework (CPE: cpe:2.3:a:spring:spring_ai:*:*:*:*:*:*:*:*) providing integrations with LLM providers including Anthropic's Skills API. The vulnerability resides in the file-write logic within this integration, where filenames sourced from LLM responses are concatenated into a path using Path.resolve() without prior sanitization. In Java, Path.resolve() does not strip or neutralize path traversal sequences such as '../', meaning an attacker-influenced filename like '../../etc/cron.d/payload' resolves to a fully qualified path outside the intended base directory. This is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal') pattern, where trust in LLM-generated content is incorrectly extended to filesystem operations. The issue is particularly notable because the attack surface is indirect - the attacker influences the LLM's output rather than directly supplying a filename parameter, which may circumvent input validation applied at the API boundary level.

RemediationAI

Consult the Spring security advisory at https://spring.io/security/cve-2026-41863 for the vendor-confirmed fixed version and apply the patch immediately; an exact fix version number was not included in the available intelligence data, so the advisory must be consulted directly to confirm the target upgrade version. Patch available per vendor advisory - do not delay upgrade for teams actively using the Anthropic Skills API integration with file-write functionality. As a compensating control prior to patching, restrict the operating system user running the Spring AI application to the minimum filesystem write permissions required, using OS-level controls (e.g., Linux file permissions, chroot, or container filesystem restrictions) to limit the blast radius of a traversal to a sandboxed directory; note this adds operational complexity and must be tested for compatibility with the application's legitimate write paths. Alternatively, if the Anthropic Skills API file-write feature is non-essential, disabling it entirely eliminates the attack surface without side effects on other Spring AI functionality.