CVE-2026-22739CWE-22path-traversal

CVE-2026-22739

High · published March 24, 2026

CVSS v3.1
8.6
EPSS
1%
Percentile
68.5
In the wild
Unconfirmed
What it is

Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01220 · 68.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-24T05:17Z
Affected products (5)
ProductVersionsFixed in
vmware/spring_cloud_config< 3.1.133.1.13
vmware/spring_cloud_config≥ 4.1.0, < 4.1.94.1.9
vmware/spring_cloud_config≥ 4.2.0, < 4.2.64.2.6
vmware/spring_cloud_config≥ 4.3.0, < 4.3.24.3.2
vmware/spring_cloud_config≥ 5.0.0, < 5.0.25.0.2
References (1)
https://spring.io/security/cve-2026-22739 · [email protected]
EPSS history
Timeline
  • 24 MAR 00:16Z
    Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
    cvelistv5