CVSS 3.1
8.6 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LCVE-2026-22739
High (8.6) in vmware spring cloud config. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in org.springframework.cloud:spring-cloud-config-server 4.3.2, 5.0.2.
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vmware:spring_cloud_config
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3qwq-q9vm-5j42 | Maven | org.springframework.cloud:spring-cloud-config-server | >=4.3.0 <4.3.2 | 4.3.2 |
| GHSA-3qwq-q9vm-5j42 | Maven | org.springframework.cloud:spring-cloud-config-server | >=5.0.0-M1 <5.0.2 | 5.0.2 |
| GHSA-3qwq-q9vm-5j42 | Maven | org.springframework.cloud:spring-cloud-config-server | >=4.2.0 <=4.2.4 | no fix published |
| GHSA-3qwq-q9vm-5j42 | Maven | org.springframework.cloud:spring-cloud-config-server | >=4.0.0 <=4.1.7 | no fix published |
| GHSA-3qwq-q9vm-5j42 | Maven | org.springframework.cloud:spring-cloud-config-server | <=3.1.10 | no fix published |