Spring Framework CVE-2026-47883

Exploitation requires that the target application explicitly deploys UrlHandlerFilter (Spring MVC's or Spring WebFlux's variant) and configures it with broadly matching URL patterns - this is not the Spring Framework default out-of-the-box configuration; the filter must be intentionally wired and given permissive patterns by the application developer. A victim user must click a crafted link (UI:R), limiting bulk automated exploitation. No authentication or account on the target system is required from the attacker side (PR:N). Exploitation is further limited to the scope of open redirect impact - no code execution, no direct data exfiltration from the server. Applications using specific, narrow UrlHandlerFilter patterns are not affected regardless of Spring version.

The NVD CVSS base score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N accurately characterizes the attack profile: network-reachable, low complexity, no privileges, but requiring a victim to click a crafted link. EPSS at 0.15% (5th percentile) and SSVC (Exploitation: none, Automatable: no, Technical Impact: partial) consistently indicate this is not being actively weaponized and is not trivially automatable at scale. The non-automatable SSVC rating is consistent with UI:R - mass exploitation via scanning bots is unlikely. No CISA KEV listing. The practical risk is confined to targeted phishing campaigns against users of applications running vulnerable Spring versions with broadly configured UrlHandlerFilter patterns; the impact is credential harvesting or user deception rather than system compromise. This is a real issue for affected applications but a low operational fire-drill priority compared to RCE or authentication-bypass class findings.

An attacker identifies a Spring application using UrlHandlerFilter with a broadly matching pattern such as '/**', then crafts a URL on the legitimate application domain that encodes a redirect to an attacker-controlled phishing site. The attacker sends the crafted link to a target user via email or message; the user clicks the link, the application's UrlHandlerFilter processes it and issues an HTTP redirect to the attacker's domain, and the user arrives at a convincing phishing page - trusting the initial URL because it appeared to originate from the legitimate application.