Security Flaw in Spring Framework Affects File Access in Web Applications
CVE-2026-22737

5.9MEDIUM

Key Information:

Vendor

Spring

Status
Spring Framework
Vendor
CVE Published:
19 March 2026

What is CVE-2026-22737?

A security flaw exists in the Spring Framework that allows for unauthorized file access through the use of the Java scripting engine in template views. This vulnerability can lead to the disclosure of content from files outside the designated script template directories in Spring MVC and Spring WebFlux applications. Developers using affected versions are urged to update to secure versions to mitigate potential data exposure risks.

Affected Version(s)

Spring Framework 7.0.0 <= 7.0.5

Spring Framework 6.2.0 <= 6.2.16

Spring Framework 6.1.0 <= 6.1.25

References

https://spring.io/security/cve-2026-22737

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.