CVE-2026-40987

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40987", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-04-16T02:19:09.389Z", "datePublished": "2026-06-11T05:03:32.606Z", "dateUpdated": "2026-06-23T19:45:07.463Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-06-23T19:45:07.463Z"}, "title": "Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content."}]}], "affected": [{"vendor": "Spring", "product": "Spring Integration", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.0.4.1", "versionType": "custom"}, {"status": "affected", "version": "6.5.0", "lessThan": "6.5.8.1", "versionType": "custom"}, {"status": "affected", "version": "6.4.0", "lessThan": "6.4.12", "versionType": "custom"}, {"status": "affected", "version": "6.3.0", "lessThan": "6.3.15", "versionType": "custom"}, {"status": "affected", "version": "5.5.0", "lessThan": "5.5.21", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.\n\nAffected versions:\nSpring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.\n\nAffected versions:\nSpring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20."}]}], "references": [{"url": "https://spring.io/security/cve-2026-40987"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T12:46:16.495655Z", "id": "CVE-2026-40987", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T12:46:24.043Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40987", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T12:46:16.495655Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T12:46:20.292Z"}}], "cna": {"title": "Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring", "product": "Spring Integration", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "7.0.4.1", "versionType": "custom"}, {"status": "affected", "version": "6.5.0", "lessThan": "6.5.8.1", "versionType": "custom"}, {"status": "affected", "version": "6.4.0", "lessThan": "6.4.12", "versionType": "custom"}, {"status": "affected", "version": "6.3.0", "lessThan": "6.3.15", "versionType": "custom"}, {"status": "affected", "version": "5.5.0", "lessThan": "5.5.21", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2026-40987"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.\n\nAffected versions:\nSpring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.", "supportingMedia": [{"type": "text/html", "value": "A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.\n\nAffected versions:\nSpring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-06-23T19:45:07.463Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40987", "state": "PUBLISHED", "dateUpdated": "2026-06-23T19:45:07.463Z", "dateReserved": "2026-04-16T02:19:09.389Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-06-11T05:03:32.606Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Spring Integration", "vendor": "Spring", "versions": [{"lessThan": "7.0.4.1", "status": "affected", "version": "7.0.0", "versionType": "custom"}, {"lessThan": "6.5.8.1", "status": "affected", "version": "6.5.0", "versionType": "custom"}, {"lessThan": "6.4.12", "status": "affected", "version": "6.4.0", "versionType": "custom"}, {"lessThan": "6.3.15", "status": "affected", "version": "6.3.0", "versionType": "custom"}, {"lessThan": "5.5.21", "status": "affected", "version": "5.5.0", "versionType": "custom"}]}], "source": "security@vmware.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*", "matchCriteriaId": "63357519-409F-4546-8EC7-861872FCC695", "versionEndExcluding": "5.5.21", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*", "matchCriteriaId": "DEABCA9B-0370-48F3-A3E9-97E31E4BB3DD", "versionEndExcluding": "6.3.15", "versionStartIncluding": "6.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*", "matchCriteriaId": "78244ED0-8F38-431C-805B-A048A86BF14F", "versionEndExcluding": "6.4.12", "versionStartIncluding": "6.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*", "matchCriteriaId": "B003C8E1-2AD5-46C3-8644-3B987921602E", "versionEndExcluding": "6.5.8.1", "versionStartIncluding": "6.5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*", "matchCriteriaId": "6DAEEC4F-3124-425F-B7CB-CDDEEF912DC1", "versionEndExcluding": "7.0.4.1", "versionStartIncluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.\n\nAffected versions:\nSpring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20."}, {"lang": "es", "value": "Un servidor FTP/SFTP/SMB malicioso o comprometido puede escribir archivos arbitrarios en cualquier lugar del sistema de archivos del cliente (fuera del directorio local configurado) con contenido controlado por el atacante.\n\nVersiones afectadas:\nSpring Integration 7.0.0 hasta 7.0.4; 6.5.0 hasta 6.5.8; 6.4.0 hasta 6.4.11; 6.3.0 hasta 6.3.14; 5.5.0 hasta 5.5.20."}], "id": "CVE-2026-40987", "lastModified": "2026-09-04T18:07:41.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.3, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40987", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-11T12:46:16.495655Z", "version": "2.0.3"}}]}, "published": "2026-06-11T07:16:27.053", "references": [{"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2026-40987"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@vmware.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Spring Integration: Spring Integration: Arbitrary file write via malicious server", "id": "2487797", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487797"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L", "status": "draft"}, "cwe": "CWE-22", "details": ["A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.\nAffected versions:\nSpring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.", "A flaw was found in Spring Integration. A malicious or compromised FTP (File Transfer Protocol), SFTP (SSH File Transfer Protocol), or SMB (Server Message Block) server can exploit this vulnerability. This allows the server to write arbitrary files with attacker-controlled content to any location on the client's filesystem, bypassing the configured local directory restrictions. This could lead to unauthorized data modification or execution of malicious code on the client system."], "mitigation": {"lang": "en:us", "value": "Restrict network access so that applications using Spring Integration file synchronization (FTP, SFTP, SMB inbound adapters) can only connect to trusted, known servers. Use firewall rules or network policies to prevent connections to untrusted endpoints. Additionally, run the application with minimal filesystem permissions to limit the impact of any arbitrary file write."}, "name": "CVE-2026-40987", "package_state": [{"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Not affected", "package_name": "spring-integration-core", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Not affected", "package_name": "spring-integration-file", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Not affected", "package_name": "spring-integration-sftp", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "spring-integration-core", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "spring-integration-http", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "spring-integration-core", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "spring-integration-file", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "spring-integration-sftp", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2026-06-11T05:03:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-40987\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40987\nhttps://spring.io/security/cve-2026-40987"], "statement": "Red Hat ships Spring Integration as a bundled dependency in several middleware products. A flaw was found in Spring Integration's FTP, SFTP, and SMB inbound file synchronization adapters where server-supplied filenames are written to the local filesystem without path canonicalization, allowing a malicious or compromised remote server to write arbitrary files outside the configured local directory. Products shipping spring-integration-file, spring-integration-sftp, or spring-integration-ftp modules are directly exposed. Products bundling only spring-integration-core may not have the vulnerable code path but are included pending detailed analysis.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.0.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.5.0,6.5.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.4.0,6.4.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.3.0,6.3.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.5.0,5.5.21)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "spring_integration", "vendor": "spring"}], "created": "2026-06-11T07:30:08.609935+00:00", "updated": "2026-06-11T10:40:24.341372+00:00", "vendors": ["spring", "spring$PRODUCT$spring_integration"]}