What is the CVSS score of EUVD-2026-13406?

EUVD-2026-13406 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by EUVD-2026-13406?

CVE-2026-22737 presents moderate security risk, a path traversal vulnerability rated CVSS 5.9. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate EUVD-2026-13406?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

Java EUVD-2026-13406

| CVE-2026-22737 MEDIUM

Path Traversal (CWE-22)

2026-03-20 security@vmware.com

GHSA-4773-3jfm-qmx3

Java Path Traversal

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 20, 2026 - 00:30 euvd

EUVD-2026-13406

Analysis Generated

Mar 20, 2026 - 00:30 vuln.today

CVE Published

Mar 20, 2026 - 00:16 nvd

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 maven packages depend on org.springframework:spring-webmvc (3 direct, 1 indirect)

Ecosystem-wide dependent count for version 7.0.0-M1.

DescriptionCVE.org

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

AnalysisAI

Spring Framework applications using Java scripting engines (JRuby, Jython) for template views in Spring MVC or Spring WebFlux can leak sensitive file contents from outside intended directories through path traversal. Affected versions include 7.0.0-7.0.5, 6.2.0-6.2.16, 6.1.0-6.1.25, and 5.3.0-5.3.46, with no patch currently available. An unauthenticated remote attacker can read arbitrary files on the system with confidentiality impact.

Technical ContextAI

This vulnerability exploits improper input validation in Spring MVC and Spring WebFlux template resolution when using Java-based scripting engines such as JRuby or Jython. These engines allow dynamic template rendering but lack sufficient path canonicalization and directory boundary enforcement. An attacker can manipulate template view parameters using path traversal sequences (e.g., ../) to escape the intended template directory and access sensitive files on the system (e.g., /etc/passwd, application configuration files, source code). The root cause falls under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) combined with inadequate input validation. Spring Framework versions 5.3.0-5.3.46, 6.1.0-6.1.25, 6.2.0-6.2.16, and 7.0.0-7.0.5 contain the flaw.

RemediationAI

Upgrade Spring Framework to patched versions immediately: 7.0.6 or later, 6.2.17 or later, 6.1.26 or later, or 5.3.47 or later, depending on your current release line. Consult the official Spring Security Advisory at https://spring.io/security/cve-2026-22737 for patch availability and release notes. If immediate patching is not feasible, disable Java scripting engine template views (JRuby, Jython) and migrate to alternative templating engines such as Thymeleaf, JSP, or FreeMarker. Apply input validation and sanitization to any user-controllable template parameters and implement strict file system access controls to limit template directories. Monitor for suspicious file access attempts in application logs.