cve.bz

CVE-2026-22737

5.9 mediumEPSS 0.4%

Medium (5.9) in vmware spring framework. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in org.springframework:spring-webmvc 6.2.17, 7.0.6.

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Severity

CVSS 3.1

5.9 medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4773-3jfm-qmx3Mavenorg.springframework:spring-webmvc>=7.0.0-M1 <7.0.67.0.6
GHSA-4773-3jfm-qmx3Mavenorg.springframework:spring-webmvc>=6.2.0 <6.2.176.2.17
GHSA-4773-3jfm-qmx3Mavenorg.springframework:spring-webmvc>=6.0.0 <=6.1.21no fix published
GHSA-4773-3jfm-qmx3Mavenorg.springframework:spring-webmvc>=5.3.0 <=5.3.39no fix published
GHSA-4773-3jfm-qmx3Mavenorg.springframework:spring-webflux>=7.0.0-M1 <7.0.67.0.6
GHSA-4773-3jfm-qmx3Mavenorg.springframework:spring-webflux>=6.2.0 <6.2.176.2.17
GHSA-4773-3jfm-qmx3Mavenorg.springframework:spring-webflux>=6.0.0 <=6.1.21no fix published
GHSA-4773-3jfm-qmx3Mavenorg.springframework:spring-webflux>=5.3.0 <=5.3.39no fix published

References

Check your stackJSON