Skip to content
OpenAdvisories
Critical · 9.1 Public exploit CVE-2026-40982 EUVD-2026-28246GHSA-6g23-24mc-hx6x

Spring Cloud Config vulnerable to Path Traversal

Published May 7, 2026 · Updated Jul 15, 2026 · Assigned by vmware

Vendor: Spring Product: Spring Cloud Config Package: org.springframework.cloud:spring-cloud-config-server Ecosystem: Maven

Description

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

Affected products

VendorProductAffectedFixed
Spring Spring Cloud Config 3.1.0 – < 3.1.14, 4.1.0 – < 4.1.10, 4.2.0 – < 4.2.7, 4.3.0 – < 4.3.3, 5.0.0 – < 5.0.3 3.1.14

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • xiaoqiMikko/scc-check ★ 0 · Aug 5, 2026

    Offline checker for Spring Cloud Config CVE-2026-40982 — tells you whether your version line has an OSS fix at all (3.1.x/4.1.x/4.2.x: it does not)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.springframework.cloud:spring-cloud-config-server <= 3.1.13 — GHSA-6g23-24mc-hx6x
Maven org.springframework.cloud:spring-cloud-config-server >= 4.1.0, <= 4.1.9 — GHSA-6g23-24mc-hx6x
Maven org.springframework.cloud:spring-cloud-config-server >= 4.2.0, <= 4.2.6 — GHSA-6g23-24mc-hx6x
Maven org.springframework.cloud:spring-cloud-config-server >= 4.3.0, < 4.3.3 4.3.3 GHSA-6g23-24mc-hx6x
Maven org.springframework.cloud:spring-cloud-config-server >= 5.0.0, < 5.0.3 5.0.3 GHSA-6g23-24mc-hx6x

Advisories 1

References