Spring Cloud Config Server Path Traversal

Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files from the file system using specially crafted URLs. Affects Spring Cloud Config versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2, with patches available across all branches. The vulnerability achieves CVSS 9.1 (Critical) due to remote exploitation without authentication (AV:N/AC:L/PR:N/UI:N) and high confidentiality/integrity impact, though EPSS and KEV data are not available to confirm active exploitation status. VMware/Spring has released fixes for all affected versions.

Time-of-check-to-time-of-use race in Spring Cloud Config Server's Git clone base directory (spring.cloud.config.server.git.basedir) can produce high confidentiality, integrity, and availability impact in affected deployments, per a CVSS 8.1 rating. Spring Cloud Config 3.1.0 through 3.1.13, 4.1.0 through 4.1.9, 4.2.0 through 4.2.6, 4.3.0 through 4.3.2, and 5.0.0 through 5.0.2 are affected; exploitation requires winning a high-complexity race (AC:H), SSVC reports no known exploitation, EPSS is 0.00%, and no public exploit has been identified at time of analysis. Fixed releases are 3.1.14, 4.1.10, 4.2.7, 4.3.3, and 5.0.3, with the first three available only under Enterprise Support.

Spring Cloud Config Server exposes sensitive information in plaintext logs when trace logging is enabled, allowing high-privilege local users to access configuration data including credentials and API keys. The vulnerability affects versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2. No public exploit identified at time of analysis; vendor-released patches are available for all affected version lines.