Directory Traversal Vulnerability in Pivotal Spring Framework
CVE-2016-9878

7.5HIGH

Key Information:

Vendor: Pivotal Software
Status: Pivotal Spring Framework Before 3.2.18, 4.2.x Before 4.2.9, And 4.3.x Before 4.3.5
Vendor: CVE Published:; 29 December 2016

🔔 Create Pivotal Software Vulnerability Alert

What is CVE-2016-9878?

A directory traversal vulnerability exists in the Pivotal Spring Framework, allowing attackers to access sensitive files outside of the web application directory. This issue arises when untrusted paths are provided to the ResourceServlet, which are not properly sanitized. As a result, malicious users can exploit this flaw to read files on the server, potentially disclosing sensitive information and compromising the integrity of the system. Users are encouraged to update to the latest versions of the Spring Framework to mitigate this risk.

Affected Version(s)

Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5 Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5