Skip to content
OpenAdvisories

Product · Spring

Spring Integration

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2026-40987 Public exploit

    Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

    A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.…

    Spring Spring Integration org.springframework.integration:spring-integration-file Maven