Description
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
INFO
Published Date :
2026-03-24T00:16:52.794Z
Last Modified :
2026-03-24T14:40:53.515Z
Source :
vmware
AFFECTED PRODUCTS
The following products are affected by CVE-2026-22739 vulnerability.
| Vendors | Products |
|---|---|
| Spring |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-22739.
| URL | Resource |
|---|---|
| https://spring.io/security/cve-2026-22739 |
|
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact