Spring Boot Forum CVE-2026-96678

Requires an authenticated forum account (PR:L) and reaching the Avatar Upload feature, whose NewUserFormValidator.validate processes the Username argument without sanitizing directory-traversal input. Exploitation is remote (AV:N) with no user interaction, but is limited by the authentication requirement and by the traversal being scoped to the avatar file-handling path, yielding only Low confidentiality/integrity impact rather than arbitrary system read or code execution. No specific non-default configuration is named; the rolling-release model means there is no known-fixed version to migrate to.

This is a genuine but low-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with E:P scores 5.3, and the impact is uniformly Low across VC/VI/VA - consistent with a path-traversal confined to an avatar-upload validator rather than full file-system read/write or code execution. The single differentiating signal is E:P (proof-of-concept exists), corroborated by a public exploit on GitHub (ssiled/cve issue #3). There is NO EPSS score and NO CISA KEV listing, so there is no evidence of automated or in-the-wild exploitation; POC availability alone does not imply active exploitation. PR:L means the attacker must already be an authenticated forum user, which materially caps opportunistic mass exploitation. The dominant real-world risk-reducer is not the CVSS math but the product itself: an obscure hobby GitHub Spring Boot forum project with negligible production footprint. Net: technically real, publicly reproducible, but low urgency. Note a data gap - rolling-release means no affected/fixed version boundaries are published, and the vendor did not respond, so remediation state cannot be pinned to a version.

An authenticated low-privilege forum user uploads or sets an avatar and supplies a crafted Username value containing directory-traversal sequences (e.g. ../) that NewUserFormValidator.validate fails to sanitize, causing the file operation to reference paths outside the intended avatar directory. Because a public POC is available (GitHub ssiled/cve issue #3), the attack is reproducible with minimal effort, though limited to the Low-impact read/write of the traversal primitive.