CVE-2026-22739
Published: 24 March 2026
Description
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search…
more
directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the path traversal vulnerability by requiring timely remediation through patching Spring Cloud Config Server to fixed versions such as 3.1.13 or later.
Validates the profile parameter in incoming requests to block path traversal sequences like '../' that enable access to files outside configured search directories.
Enforces logical access controls on file system resources to restrict reads to only approved directories, limiting exploitation impact even if input validation fails.
Security SummaryAI
CVE-2026-22739 is a path traversal vulnerability (CWE-22) in Spring Cloud Config Server when configured with a native file system backend. It arises during substitution of the profile parameter from incoming requests, allowing access to files outside the configured search directories. The issue affects Spring Cloud versions from 3.1.x prior to 3.1.13, 4.1.x prior to 4.1.9, 4.2.x prior to 4.2.3, 4.3.x prior to 4.3.2, and 5.0.x prior to 5.0.2.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). By crafting a request with a malicious profile parameter, the attacker can traverse directory boundaries to read sensitive files, achieving high confidentiality impact, along with limited integrity and availability effects.
Mitigation details are available in the official Spring advisory at https://spring.io/security/cve-2026-22739, which recommends upgrading to the fixed versions: 3.1.13, 4.1.9, 4.2.3, 4.3.2, or 5.0.2.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing Spring Cloud Config Server enables exploitation of public-facing applications (T1190) and unauthorized reading of sensitive files from the local system (T1005).