EUVD-2026-14664
GHSA-3qwq-q9vm-5j42
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend malicious profile parameter to Spring Cloud Config Server
-
ExploitBypass directory traversal restrictions via path manipulation
-
ExecutionAccess files outside configured search directories
-
ImpactRead sensitive configuration or application files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Spring Cloud Config Server with native file system backend enabled. Remote unauthenticated attacker can exploit via profile parameter manipulation to access files outside configured search directories. Affects versions 3.1.0-3.1.12, 4.1.0-4.1.8, 4.2.0-4.2.2, 4.3.0-4.3.1, 5.0.0-5.0.1. |
| Impact | The CVSS 3.1 score of 8.6 (High) reflects a remotely exploitable vulnerability with low attack complexity requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), resulting in high confidentiality impact (C:H) and low integrity and availability impact (I:L/A:L). The network accessibility and lack of authentication requirements make this readily exploitable against internet-facing Spring Cloud Config Server instances. The high confidentiality impact is particularly concerning as configuration files often contain sensitive data including database credentials, API keys, and other secrets used across microservices deployments. While no EPSS score or KEV status is provided in the available data, the combination of ease of exploitation, potential for credential harvesting, and widespread deployment of Spring Cloud in enterprise Java environments suggests this vulnerability warrants urgent attention for affected organizations. The low integrity and availability scores indicate the attacker's ability to potentially modify or disrupt operations beyond just reading files, though reading sensitive configuration data represents the primary risk vector. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies an internet-accessible Spring Cloud Config Server using the native file system backend through reconnaissance of common Spring Boot management endpoints or error messages. The attacker crafts HTTP requests to the Config Server manipulating the profile parameter with path traversal sequences such as '../../../etc/passwd' or '../../../opt/app/secrets/database.properties' to read arbitrary files outside the intended configuration directories. By iterating through common file paths and configuration locations, the attacker successfully exfiltrates application configuration files containing database credentials, API keys, OAuth secrets, and other sensitive information used throughout the organization's microservices environment, enabling lateral movement and further compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 24, 2026
Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing unauthenticated remote attackers to access arbitrary files outside configured search directories by manipulating the profile parameter in requests. This affects Spring Cloud versions 3.1.X before 3.1.13, 4.1.X before 4.1.9, 4.2.X before 4.2.3, 4.3.X before 4.3.2, and 5.0.X before 5.0.2. With a CVSS score of 8.6 indicating high confidentiality impact with some integrity and availability impact, and network-based attack vector requiring no authentication, this represents a significant information disclosure risk for exposed Config Server instances.
RemediationAI
Upgrade Spring Cloud to the patched versions immediately: version 3.1.13 or later for the 3.1.X branch, version 4.1.9 or later for 4.1.X, version 4.2.3 or later for 4.2.X, version 4.3.2 or later for 4.3.X, or version 5.0.2 or later for 5.0.X as documented in the VMware security advisory at https://spring.io/security/cve-2026-22739. Organizations unable to immediately patch should implement network-level access controls to restrict Config Server access to only trusted internal IP ranges and authenticated clients. Consider migrating from the native file system backend to Git-based configuration storage which is less susceptible to this type of path traversal vulnerability. Review application logs for suspicious profile parameter values that may indicate exploitation attempts, particularly those containing directory traversal sequences like '../' or absolute file paths. Conduct a security assessment of any potentially exposed sensitive configuration data and rotate credentials as a precautionary measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Spring Cloud Config Server is a centralized configuration management service commonly used in microservices architectures to externalize application configuration. When configured to use the native file system profile as a backend storage mechanism, the server retrieves configuration files from local directories. The vulnerability exists in the profile parameter handling logic where insufficient input validation allows path traversal sequences to escape the intended configuration search directories. According to the CPE identifier cpe:2.3:a:spring:spring_cloud, this affects the core Spring Cloud product maintained by VMware. The flaw enables directory traversal attacks, a common vulnerability pattern where attackers manipulate file path references to access unauthorized locations in the file system hierarchy.
Know when Spring gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Primary rating from Vendor (vmware) · only source for this CVE.
CVSS VectorVendor: vmware
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
Blast Radius
ecosystem impact- 8 maven packages depend on org.springframework.cloud:spring-cloud-config-server (7 direct, 1 indirect)
Ecosystem-wide dependent count for version 4.3.0.
Executive ViewAI
Spring Cloud Config Server instances are vulnerable to unauthorized file access through a path traversal flaw, potentially exposing sensitive configuration data, credentials, and proprietary information to unauthenticated attackers. Any organization running affected Spring Cloud versions with Config Server exposed to untrusted networks faces immediate risk of data breach and compliance violations.
Implement Web Application Firewall (WAF) rules to block requests with suspicious profile parameters containing path traversal patterns (../, ..\); restrict network access to Config Server via IP whitelisting or VPN; disable native file system backend if alternative backends are available; move sensitive data from configuration files to dedicated secrets management solutions; enable detailed audit logging for all Config Server requests; consider disabling Config Server entirely if not actively used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Access control bypass in SpringBlade v4.5.0 importUser function allows low-privileged users to import sensitive user dat
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant
SpringBlade v4.5.0 has an access control flaw in authRoutes allowing low-privileged users to escalate to admin through t
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated at
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Sprin
Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJso
Spring Security Aspects may not correctly locate method security annotations on private methods. Rated critical severity
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input esca
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files
Spring Security fails to properly write HTTP response headers in servlet applications across multiple versions (5.7.0-5.
Spring Boot's RabbitMQ auto-configuration omits TLS hostname verification when an SSL bundle is configured, enabling a m
Exploit-DB