Spring Framework CVE-2026-59280

Exploitation requires three concurrent conditions: (1) the application uses Spring Framework's FreeMarker view integration with SpringTemplateLoader as the template resolver; (2) a Spring MVC controller returns a view name that is wholly or partially derived from attacker-controlled input (request parameter, path variable, header, or similar); and (3) the attacker holds a valid authenticated session (PR:L per CVSS vector). Applications that construct view names from hard-coded strings or internally validated enumerations are not exploitable regardless of their Spring or FreeMarker version. Exploitation is further limited by the non-automatable nature of the attack: an attacker must first identify a vulnerable controller endpoint, which varies by application. Impact is limited to confidentiality of files accessible via the SpringTemplateLoader base path - no write or execution capability is implied by CWE-22 in this context.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a moderate, narrowly bounded risk: network-reachable but requiring prior authentication (PR:L), with only partial confidentiality impact and no integrity or availability consequences. SSVC reinforces this calibration - exploitation is rated 'none' at time of analysis, the attack is classified non-automatable (because a specific application coding pattern must exist), and technical impact is partial. EPSS data is not included in the source intelligence, so exploitation probability cannot be precisely quantified; however, the combination of no KEV listing, no public exploit, and a configuration-dependent trigger suggests low near-term exploitation probability. The main risk amplifier is breadth of affected versions: every Spring Framework release line from 5.2.x through 7.0.8 is vulnerable, meaning organizations running any unpatched Spring application with FreeMarker templating should audit whether untrusted input reaches view name resolution. The attack is not automatable at scale because exploitation requires identifying a specific controller pattern, not merely scanning for the presence of Spring Framework.

An authenticated user submits an HTTP request to a Spring MVC endpoint that passes a request parameter directly to the view resolver - for example, a 'template' query parameter mapped to the view name. By supplying a value such as '../../WEB-INF/applicationContext' the attacker causes SpringTemplateLoader to traverse outside the designated template directory and return the rendered content of a sensitive configuration file. No public proof-of-concept code has been identified, so exploitation currently requires manual discovery of a vulnerable controller pattern within the target application.