Description
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Spring Cloud | 3.1.x – < 3.1.13, 4.1.x – < 4.1.9, 4.2.x – < 4.2.3, 4.3.x – < 4.3.2, 5.0.x – < 5.0.2 | 3.1.13 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Spring Cloud Config Server - Path Traversal http/cves/2026/CVE-2026-22739.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-config-server | >= 4.3.0, < 4.3.2 | 4.3.2 | GHSA-3qwq-q9vm-5j42 |
| Maven | org.springframework.cloud:spring-cloud-config-server | >= 5.0.0-M1, < 5.0.2 | 5.0.2 | GHSA-3qwq-q9vm-5j42 |
| Maven | org.springframework.cloud:spring-cloud-config-server | >= 4.2.0, <= 4.2.4 | — | GHSA-3qwq-q9vm-5j42 |
| Maven | org.springframework.cloud:spring-cloud-config-server | >= 4.0.0, <= 4.1.7 | — | GHSA-3qwq-q9vm-5j42 |
| Maven | org.springframework.cloud:spring-cloud-config-server | <= 3.1.10 | — | GHSA-3qwq-q9vm-5j42 |
Advisories 1
- WID-SEC-2026-0829 VMware Tanzu Spring Cloud: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Mar 23, 2026