CVE-2026-41843

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41843
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-41843.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-41843
Aliases
Downstream
CGA (35)
CLEANSTART (3)
CLSA (9)
DEBIAN (1)
ECHO (1)
MINI (10)
RHLW (1)
UBUNTU (1)
Published
2026-06-09T03:50:34Z
Modified
2026-11-01T10:45:25Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux
Details

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.

Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Database specific 
{
    "cna_assigner": "vmware",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41843.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "7.0.0"
                        },
                        {
                            "fixed": "7.0.7.1"
                        },
                        {
                            "introduced": "6.2.0"
                        },
                        {
                            "fixed": "6.2.18.1"
                        },
                        {
                            "introduced": "6.1.0"
                        },
                        {
                            "fixed": "6.1.28"
                        },
                        {
                            "introduced": "5.3.0"
                        },
                        {
                            "fixed": "5.3.49"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/spring-projects/spring-framework

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-framework
Events
Introduced
fe00848be255db1455f0189d9ff28661f301be36
Last Affected
c997d4018d3dc6a7dde2e20eae3627599a01e169
Introduced
5024bb72279188f1d0dcfe19e8abdd4bdb9887c8
Last Affected
6b117247d383294662e199c6b47d7bf54c49caaa
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "last_affected": "7.0.7"
                }
            ],
            "source": "DESCRIPTION"
        },
        {
            "range": [
                {
                    "introduced": "6.2.0"
                },
                {
                    "last_affected": "6.2.18"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-41843.json"