Vulnerability Directory | CVE-2026-22737 | Spring

Overview

Spring Framework is an open-source application framework for the Java platform that provides comprehensive infrastructure support for developing enterprise-level Java applications. It offers features including dependency injection, web frameworks (Spring MVC and WebFlux), data access, messaging, and more.

A medium-severity vulnerability (CVE-2026-22737) has been identified in Spring Framework. The ScriptTemplateView class in both Spring MVC and Spring WebFlux does not properly validate or normalize the resource location before resolving templates. The getResource(String location) method concatenates a resource loader path with the location parameter without performing path traversal checks, and it does not verify that the resolved resource is actually under the configured base path. An attacker who can influence the template location may be able to read arbitrary files accessible to the application process.

Per OWASP: A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code or configuration and critical system files.

This issue affects versions 4.2.0 through 6.2.16 and 7.0.0 through 7.0.5 of Spring Framework.

‍

Details

Module Info

Product: Spring Framework
Affected packages: spring-webmvc, spring-webflux
Affected versions: >=4.2.0 <=6.2.16, >=7.0.0 <=7.0.5
GitHub repository: https://github.com/spring-projects/spring-framework
Published packages: https://repo1.maven.org/maven2/org/springframework/
Package manager: Maven
Fixed in: Spring Framework 7.0.6, 6.2.17 (OSS); NES for Spring

‍

Vulnerability Info

This medium-severity vulnerability is found in the ScriptTemplateView class within both the spring-webmvc and spring-webflux modules of Spring Framework across all listed affected versions.

ScriptTemplateView enables server-side rendering using JSR 223 script engines (such as Nashorn, GraalJS, or other JavaScript engines). Applications configure it with one or more resource loader paths where templates are expected to reside (typically under WEB-INF/). When a template is requested, the getResource(String location) method resolves the template file by iterating over the configured paths and concatenating each with the provided location.

Prior to the fix, the getResource() method had three issues:

1. No path normalization. The location parameter was concatenated directly with the resource loader path without being normalized. Path traversal sequences such as ../ were passed through as-is.

2. No traversal rejection. No check was performed to detect and reject suspicious input containing path traversal sequences.

3. No boundary enforcement. The method only checked resource.exists() and did not verify that the resolved resource was actually located under the configured base path.

Additionally, the setResourceLoaderPath(String) method prepended an empty string ("") as the first element of the resource loader paths array. This meant resources could be resolved against the application root even when the user explicitly configured a restricted base path such as classpath:templates/.

‍

Mitigation

Only recent versions of Spring Framework receive community support and updates. Older versions have no publicly available fixes for this vulnerability.

Users of the affected components should apply one of the following mitigations: