Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Spring Framework's spring-webmvc package is affected in versions from 6.2.0 before 6.2.10, from 6.1.0 through 6.1.21, from 6.0.0 through 6.0.29, and from 5.3.0 through 5.3.43. The issue applies when the application is deployed as a WAR or with an embedded Servlet container that does not reject suspicious path sequences and serves static resources through Spring resource handling. The source gives few details on the exact attack steps. Upgrade to spring-webmvc 6.2.10 or a later fixed release.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.9 | Medium | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | CNA (vmware) |
- CISA KEV Not listed.
- EPSS 0.023, the 83rd percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:17 UTC First seen by agentprime
- 31 Oct 2026, 14:17 UTC Confirmed by OSV