GHSA-792x-6vq6-j8r9

Source

https://github.com/advisories/GHSA-792x-6vq6-j8r9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-792x-6vq6-j8r9/GHSA-792x-6vq6-j8r9.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-792x-6vq6-j8r9

Aliases

CVE-2026-40987

Published

2026-06-11T09:31:55Z

Modified

2026-08-07T19:15:07Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L CVSS Calculator

Summary

Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem

Details

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.

Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T20:35:04Z",
    "nvd_published_at": "2026-06-11T07:16:27Z",
    "severity": "HIGH"
}

References

Affected packages

Maven

org.springframework.integration:spring-integration-file

Package

Name: org.springframework.integration:spring-integration-file; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.integration/spring-integration-file

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.0.5

Affected versions

7.*

7.0.0

7.0.1

7.0.2

7.0.3

7.0.4

Database specific

last_known_affected_version_range

"<= 7.0.4"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-792x-6vq6-j8r9/GHSA-792x-6vq6-j8r9.json"

org.springframework.integration:spring-integration-file

Package

Name: org.springframework.integration:spring-integration-file; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.integration/spring-integration-file

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.5.0

Fixed

6.5.9

Affected versions

6.*

6.5.0

6.5.1

6.5.2

6.5.3

6.5.4

6.5.5

6.5.6

6.5.7

6.5.8

Database specific

last_known_affected_version_range

"<= 6.5.8"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-792x-6vq6-j8r9/GHSA-792x-6vq6-j8r9.json"

org.springframework.integration:spring-integration-file

Package

Name: org.springframework.integration:spring-integration-file; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.integration/spring-integration-file

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.4.0

Last Affected

6.4.11

Affected versions

6.*

6.4.0

6.4.1

6.4.2

6.4.3

6.4.4

6.4.5

6.4.6

6.4.7

6.4.8

6.4.9

6.4.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-792x-6vq6-j8r9/GHSA-792x-6vq6-j8r9.json"

org.springframework.integration:spring-integration-file

Package

Name: org.springframework.integration:spring-integration-file; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.integration/spring-integration-file

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.3.0

Last Affected

6.3.14

Affected versions

6.*

6.3.0

6.3.1

6.3.2

6.3.3

6.3.4

6.3.5

6.3.6

6.3.7

6.3.8

6.3.9

6.3.10

6.3.11

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-792x-6vq6-j8r9/GHSA-792x-6vq6-j8r9.json"

org.springframework.integration:spring-integration-file

Package

Name: org.springframework.integration:spring-integration-file; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.integration/spring-integration-file

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

5.5.20

Affected versions

1.*

1.0.1.RELEASE

1.0.2.RELEASE

1.0.2.SR1

1.0.3.RELEASE

1.0.4.RELEASE

2.*

2.0.0.RELEASE

2.0.1.RELEASE

2.0.3.RELEASE

2.0.4.RELEASE

2.0.5.RELEASE

2.0.6.RELEASE

2.1.0.RELEASE

2.1.1.RELEASE

2.1.2.RELEASE

2.1.3.RELEASE

2.1.4.RELEASE

2.1.5.RELEASE

2.1.6.RELEASE

2.2.0.RELEASE

2.2.1.RELEASE

2.2.2.RELEASE

2.2.3.RELEASE

2.2.4.RELEASE

2.2.5.RELEASE

2.2.6.RELEASE

2.2.7.RELEASE

3.*

3.0.0.RELEASE

3.0.1.RELEASE

3.0.2.RELEASE

3.0.3.RELEASE

3.0.4.RELEASE

3.0.5.RELEASE

3.0.6.RELEASE

3.0.7.RELEASE

3.0.8.RELEASE

4.*

4.0.0.RELEASE

4.0.1.RELEASE

4.0.2.RELEASE

4.0.3.RELEASE

4.0.4.RELEASE

4.0.5.RELEASE

4.0.6.RELEASE

4.0.7.RELEASE

4.0.8.RELEASE

4.0.9.RELEASE

4.1.0.RELEASE

4.1.1.RELEASE

4.1.2.RELEASE

4.1.3.RELEASE

4.1.4.RELEASE

4.1.5.RELEASE

4.1.6.RELEASE

4.1.7.RELEASE

4.1.8.RELEASE

4.1.9.RELEASE

4.2.0.RELEASE

4.2.1.RELEASE

4.2.2.RELEASE

4.2.3.RELEASE

4.2.4.RELEASE

4.2.5.RELEASE

4.2.6.RELEASE

4.2.7.RELEASE

4.2.8.RELEASE

4.2.9.RELEASE

4.2.11.RELEASE

4.2.12.RELEASE

4.2.13.RELEASE

4.3.0.RELEASE

4.3.1.RELEASE

4.3.2.RELEASE

4.3.4.RELEASE

4.3.5.RELEASE

4.3.6.RELEASE

4.3.7.RELEASE

4.3.8.RELEASE

4.3.9.RELEASE

4.3.10.RELEASE

4.3.11.RELEASE

4.3.12.RELEASE

4.3.13.RELEASE

4.3.14.RELEASE

4.3.15.RELEASE

4.3.16.RELEASE

4.3.17.RELEASE

4.3.18.RELEASE

4.3.19.RELEASE

4.3.20.RELEASE

4.3.21.RELEASE

4.3.22.RELEASE

4.3.23.RELEASE

4.3.24.RELEASE

5.*

5.0.0.RELEASE

5.0.1.RELEASE

5.0.2.RELEASE

5.0.3.RELEASE

5.0.4.RELEASE

5.0.5.RELEASE

5.0.6.RELEASE

5.0.7.RELEASE

5.0.8.RELEASE

5.0.9.RELEASE

5.0.10.RELEASE

5.0.11.RELEASE

5.0.12.RELEASE

5.0.13.RELEASE

5.0.14.RELEASE

5.1.0.RELEASE

5.1.1.RELEASE

5.1.2.RELEASE

5.1.3.RELEASE

5.1.4.RELEASE

5.1.5.RELEASE

5.1.6.RELEASE

5.1.7.RELEASE

5.1.8.RELEASE

5.1.9.RELEASE

5.1.10.RELEASE

5.1.11.RELEASE

5.1.12.RELEASE

5.1.13.RELEASE

5.2.0.RELEASE

5.2.1.RELEASE

5.2.2.RELEASE

5.2.3.RELEASE

5.2.4.RELEASE

5.2.5.RELEASE

5.2.6.RELEASE

5.2.7.RELEASE

5.2.8.RELEASE

5.2.9.RELEASE

5.2.10.RELEASE

5.2.11.RELEASE

5.3.0.RELEASE

5.3.1.RELEASE

5.3.2.RELEASE

5.3.3.RELEASE

5.3.4.RELEASE

5.3.5.RELEASE

5.3.6.RELEASE

5.3.7.RELEASE

5.3.8.RELEASE

5.3.9.RELEASE

5.3.10.RELEASE

5.4.0

5.4.1

5.4.2

5.4.3

5.4.4

5.4.5

5.4.6

5.4.7

5.4.8

5.4.9

5.4.10

5.4.11

5.4.12

5.4.13

5.5.0

5.5.1

5.5.2

5.5.3

5.5.4

5.5.5

5.5.6

5.5.7

5.5.8

5.5.9

5.5.10

5.5.11

5.5.12

5.5.13

5.5.14

5.5.15

5.5.16

5.5.17

5.5.18

5.5.19

5.5.20

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-792x-6vq6-j8r9/GHSA-792x-6vq6-j8r9.json"