CVE-2026-47862

Overview

Spring Integration extends the Spring programming model to support the well-known Enterprise Integration Patterns, providing message channels, endpoints, transformers, and channel adapters that let Spring applications exchange data with external systems over protocols such as HTTP, JMS, AMQP, TCP/UDP, syslog, and the file system.

A Path Traversal vulnerability (CVE-2026-47862) has been identified in the ZipTransformer component of Spring Integration, which allows attackers who can influence the file_name message header to have the generated archive written to an arbitrary filesystem path outside the configured work directory.

Per OWASP: A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files.

This issue affects the zip transformer support of Spring Integration.

Details

Module Info

• Product: Spring Integration
• Affected packages: org.springframework.integration:spring-integration-zip
• Affected versions: >= 6.1.0 <= 6.4.12, >= 6.5.0 <= 6.5.10, >= 7.0.0 < 7.0.6, >= 7.1.0 < 7.1.1
• GitHub repository: https://github.com/spring-projects/spring-integration
• Published packages: https://central.sonatype.com/artifact/org.springframework.integration/spring-integration-zip
• Package manager: Maven
• Fixed in:
  
  • NES for Spring Integration lines 6.2.x, 6.3.x, 6.4.x and 6.5.x
  • OSS Spring Integration 7.0.6 and 7.1.1

Vulnerability Info

This Medium-severity vulnerability is found in the org.springframework.integration:spring-integration-zip package in the zip transformer support of Spring Integration.

With the default result type of FILE, the transformer derives the archive name from the file_name message header (directly on 6.1.x through 6.3.x, and through the default file name generator from 6.4.0 on) and then joins it onto the work directory with a plain File constructor:

@Override
protected Object doZipTransform(Message<?> message) {
    Object payload = message.getPayload();
    MessageHeaders messageHeaders = message.getHeaders();

    String baseFileName = this.fileNameGenerator.generateFileName(message);
    String zipFileName = baseFileName.endsWith(ZIP_EXTENSION) ? baseFileName : baseFileName + ZIP_EXTENSION;
    ...
    byte[] zippedBytes = SpringZipUtils.pack(entries, this.compressionLevel);

    Object zippedData;
    if (ZipResultType.FILE.equals(this.zipResultType)) {
        final File zippedFile = new File(this.workDirectory, zipFileName);
        try {
            FileCopyUtils.copy(zippedBytes, zippedFile);
        }
        catch (IOException ex) {
            throw new UncheckedIOException(ex);
        }
        zippedData = zippedFile;
    }
    ...
}

That header is routinely populated from upstream input such as an uploaded file name or a remote directory listing. new File(this.workDirectory, zipFileName) performs no normalization, so a name containing parent-directory (../) segments resolves outside the work directory and the archive is written there. A symlinked work directory is a separate route out of the intended location, tracked as CVE-2026-59311; the NES lines close it by rejecting a symbolic-linked work directory when the transformer initializes, rather than by canonicalizing the work directory path.

This vulnerability was introduced in 2023 with Spring Integration 6.1.0.

Mitigation

Only recent versions of Spring Integration receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Integration.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Naveed Khan (finder)