CVE-2026-40985

Overview

Spring Web Flow is a module of the Spring portfolio that adds support for building stateful, flow-based user interactions on top of Spring MVC, modeling multi-step navigation (such as wizards and checkout flows) as reusable flow definitions.

A medium-severity vulnerability (CVE-2026-40985) has been identified in Spring Web Flow. Applications that explicitly configure the WebFlowELExpressionParser (or its base class ELExpressionParser) are vulnerable to malicious Unified Expression Language (EL) expressions. During automatic data binding, an attacker-controlled request parameter name is parsed and evaluated as a Unified EL expression against the model, allowing expression injection and potentially the execution of arbitrary code.

Per OWASP, Expression Language Injection occurs when user input is evaluated as an expression by an EL interpreter, allowing an attacker to access and manipulate application objects and, in many cases, execute arbitrary code.

This issue affects >=2.5.0 <=2.5.1, >=3.0.0 <=3.0.1, and 4.0.0 of Spring Web Flow.

‍

Details

Module Info

• Product: Spring Web Flow
• Affected packages: spring-webflow
• Affected versions: >=2.5.0 <=2.5.1, >=3.0.0 <=3.0.1, 4.0.0
• GitHub repository: https://github.com/spring-projects/spring-webflow
• Published packages: https://central.sonatype.com/artifact/org.springframework.webflow/spring-webflow
• Package manager: Maven
• Fixed in: NES for Spring Web Flow 2.5.x; Spring Web Flow 4.0.1, 3.0.2 (OSS)

Vulnerability Info

The vulnerability is exposed when an application configures Spring Web Flow with the EL-based parser and relies on automatic data binding rather than explicit binding declarations. The pre-conditions are:

• The application explicitly configures the WebFlowELExpressionParser or its base class ELExpressionParser.
• The useSpringBinding configuration property has not been set to true.
• View states do not use the <binding> element to declare which properties to bind, so default mapping is in effect.

When these conditions hold, AbstractMvcView builds a default mapping for every request parameter and parses the parameter name into a target expression using the configured expression parser. With an EL parser in place, the attacker-supplied parameter name is treated as a Unified EL expression and evaluated against the model:

protected void addDefaultMapping(DefaultMapper mapper, String parameter, Object model) {
Expression source = new RequestParameterExpression(parameter);
ParserContext parserContext = new SimpleParserContext(model.getClass());
if (expressionParser instanceof BeanWrapperExpressionParser || checkModelProperty(parameter, model)) {
Expression target = expressionParser.parseExpression(parameter, parserContext);
DefaultMapping mapping = new DefaultMapping(source, target);
mapper.addMapping(mapping);
}
}

Because the configured EL parser evaluates the attacker-controlled parameter name, a crafted request can inject an EL expression that reads or modifies application objects and may lead to arbitrary code execution. The remediation routes default mappings through a dedicated, non-EL property-path parser (BeanWrapperExpressionParser) whenever an ELExpressionParser is configured, so request parameter names are no longer evaluated as expressions.

This vulnerability has been present since at least Spring Web Flow 2.0.0.

‍

Mitigation

Spring Web Flow 2.5.x is End-of-Life and the 2.5 line has no publicly available fix. Affected users should not attempt to author their own patches.

Recommended actions:

1. Upgrade to a supported, fixed Spring Web Flow release (4.0.1 or 3.0.2).
2. If upgrading is not feasible because you depend on the End-of-Life 2.5.x line, obtain a supported, patched build through a commercial support partner like HeroDevs Never-Ending Support (NES): https://www.herodevs.com/support/spring-nes