Path Traversal Vulnerability in Spring Framework Affecting Multiple Versions
CVE-2026-59280

4.3MEDIUM

Key Information:

Vendor

Spring

Status
Spring Framework
Vendor
CVE Published:
27 August 2026

What is CVE-2026-59280?

Applications using the Spring Framework's FreeMarker integration may be exposed to a path traversal vulnerability. This occurs when view names, derived from untrusted input, are returned by a controller, while FreeMarker is set up to resolve templates using SpringTemplateLoader. Attackers could potentially exploit this weakness to access unintended files in the filesystem, posing significant security risks.

Affected Version(s)

Spring Framework 7.0.0 <= 7.0.8

Spring Framework 6.2.0 <= 6.2.19

Spring Framework 6.1.0 <= 6.1.28

References

https://spring.io/security/cve-2026-59280

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.