Path Traversal Vulnerability in Spring Framework Affecting Multiple Versions
CVE-2026-59280

Currently unrated

Key Information:

Vendor

Spring

Status
Spring Framework
Vendor
CVE Published:
27 August 2026

What is CVE-2026-59280?

Applications using the Spring Framework's FreeMarker integration may be exposed to a path traversal vulnerability. This occurs when view names, derived from untrusted input, are returned by a controller, while FreeMarker is set up to resolve templates using SpringTemplateLoader. Attackers could potentially exploit this weakness to access unintended files in the filesystem, posing significant security risks.

Affected Version(s)

Spring Framework 7.0.0 <= 7.0.8

Spring Framework 6.2.0 <= 6.2.19

Spring Framework 6.1.0 <= 6.1.28

References

https://spring.io/security/cve-2026-59280

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.