CVE-2026-22737

Spring Framework Improper Path Limitation with Script View Templates

Medium · published March 19, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
33.1
In the wild
Unconfirmed
What it is

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00400 · 33.1th percentile
Published
2026-03-19T23:53Z
EPSS history
Timeline
  • 19 MAR 23:53Z
    Spring Framework Improper Path Limitation with Script View Templates
    cvelistv5