CVE-2026-22739

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22739", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-01-09T06:54:49.675Z", "datePublished": "2026-03-24T00:16:52.794Z", "dateUpdated": "2026-03-24T14:40:53.515Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-03-24T00:16:52.794Z"}, "title": "Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks", "affected": [{"vendor": "Spring", "product": "Spring Cloud", "versions": [{"status": "affected", "version": "3.1.x", "lessThan": "3.1.13", "versionType": "custom"}, {"status": "affected", "version": "4.1.x", "lessThan": "4.1.9", "versionType": "custom"}, {"status": "affected", "version": "4.2.x", "lessThan": "4.2.3", "versionType": "custom"}, {"status": "affected", "version": "4.3.x", "lessThan": "4.3.2", "versionType": "custom"}, {"status": "affected", "version": "5.0.x", "lessThan": "5.0.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.<p>This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.</p>"}]}], "references": [{"url": "https://spring.io/security/cve-2026-22739"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "https://spring.io/security/cve-2026-22739"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T14:40:20.315216Z", "id": "CVE-2026-22739", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:40:53.515Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22739", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T14:40:20.315216Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:39:35.975Z"}}], "cna": {"title": "Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "https://spring.io/security/cve-2026-22739"}]}], "affected": [{"vendor": "Spring", "product": "Spring Cloud", "versions": [{"status": "affected", "version": "3.1.x", "lessThan": "3.1.13", "versionType": "custom"}, {"status": "affected", "version": "4.1.x", "lessThan": "4.1.9", "versionType": "custom"}, {"status": "affected", "version": "4.2.x", "lessThan": "4.2.3", "versionType": "custom"}, {"status": "affected", "version": "4.3.x", "lessThan": "4.3.2", "versionType": "custom"}, {"status": "affected", "version": "5.0.x", "lessThan": "5.0.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2026-22739"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.", "supportingMedia": [{"type": "text/html", "value": "Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.<p>This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.</p>", "base64": false}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-03-24T00:16:52.794Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22739", "state": "PUBLISHED", "dateUpdated": "2026-03-24T14:40:53.515Z", "dateReserved": "2026-01-09T06:54:49.675Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-03-24T00:16:52.794Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Spring Cloud", "vendor": "Spring", "versions": [{"lessThan": "3.1.13", "status": "affected", "version": "3.1.x", "versionType": "custom"}, {"lessThan": "4.1.9", "status": "affected", "version": "4.1.x", "versionType": "custom"}, {"lessThan": "4.2.3", "status": "affected", "version": "4.2.x", "versionType": "custom"}, {"lessThan": "4.3.2", "status": "affected", "version": "4.3.x", "versionType": "custom"}, {"lessThan": "5.0.2", "status": "affected", "version": "5.0.x", "versionType": "custom"}]}], "source": "security@vmware.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*", "matchCriteriaId": "2FA3D9C4-2F28-4618-BE23-D842BA731B5A", "versionEndExcluding": "3.1.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*", "matchCriteriaId": "D34AA749-B195-4004-8408-F60B146B7250", "versionEndExcluding": "4.1.9", "versionStartIncluding": "4.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*", "matchCriteriaId": "535D6C3E-D8E8-4B5F-8F3B-76D7453C8C03", "versionEndExcluding": "4.2.6", "versionStartIncluding": "4.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*", "matchCriteriaId": "836857C0-8E64-4D34-BBE0-07D31F4D7AAB", "versionEndExcluding": "4.3.2", "versionStartIncluding": "4.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_cloud_config:*:*:*:*:*:*:*:*", "matchCriteriaId": "C28EB16B-C0CB-42F7-A158-D8E72E3A7208", "versionEndExcluding": "5.0.2", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2."}, {"lang": "es", "value": "Vulnerabilidad en Spring Cloud al sustituir el par\u00e1metro de perfil de una solicitud realizada al Spring Cloud Config Server configurado para el sistema de archivos nativo como backend, porque era posible acceder a archivos fuera de los directorios de b\u00fasqueda configurados. Este problema afecta a Spring Cloud: desde 3.1.X antes de 3.1.13, desde 4.1.X antes de 4.1.9, desde 4.2.X antes de 4.2.3, desde 4.3.X antes de 4.3.2, desde 5.0.X antes de 5.0.2."}], "id": "CVE-2026-22739", "lastModified": "2026-09-04T20:04:45.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22739", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T14:40:20.315216Z", "version": "2.0.3"}}]}, "published": "2026-03-24T01:17:00.910", "references": [{"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2026-22739"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.1.x,3.1.13)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.x,4.1.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.2.x,4.2.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.3.x,4.3.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.0.x,5.0.2)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "Spring Cloud", "source": "cna", "vendor": "Spring"}, "product": "spring", "vendor": "spring"}], "created": "2026-03-24T10:29:36.264062+00:00", "updated": "2026-06-18T04:30:16.110681+00:00", "vendors": ["spring", "spring$PRODUCT$spring"]}