File Injection Vulnerability in Spring AI by VMWare
CVE-2026-41863

6.5MEDIUM

Key Information:

Vendor

Spring

Status
Spring Ai
Vendor
CVE Published:
25 May 2026

What is CVE-2026-41863?

A file injection vulnerability exists in Spring AI due to the handling of unsanitized filenames from Anthropic's Skills API. This weakness allows an attacker to manipulate the filename resolution process, potentially writing files outside the designated directory, including access to restricted paths. This could lead to unauthorized data exposure and system compromise.

Affected Version(s)

Spring AI 1.1.0 <= 1.1.x

References

https://spring.io/security/cve-2026-41863

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.