CVE-2026-47884: spring spring framework Path Traversal
CVSS: 9.8v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-47884DEBIAN-CVE-2026-47884CGA-5m4g-p3mw-xfh7CGA-qhxw-g9g4-h374CGA-wvgj-p3mm-x983CGA-x784-pwhg-7vh6CGA-226v-grx6-qh63CGA-2gm9-p4xq-vw4vCGA-2hg7-9679-hjcjCGA-2vfx-42vj-f436CGA-36hr-6m24-rmp7CGA-38h3-cqv4-xj26CGA-3mqq-qhq8-xxv3CGA-3mqr-5796-3xvfCGA-5836-9pxr-p37jCGA-5865-wm87-8f2xCGA-5hfg-vpf3-pf7vCGA-5mx5-5wv7-2j9qCGA-5mxw-vcwf-4ghwCGA-5vcp-qmqp-22wpCGA-6f4h-4hg9-ccp8CGA-6f5x-7pf7-j393CGA-6jh7-qj93-w37mCGA-7r5q-rf26-qw9rCGA-836f-cwr3-52q6CGA-8757-m5g9-r9xjCGA-88hh-6mfg-5g2vCGA-88hm-p5h5-267hCGA-8p96-qfcc-46wjCGA-8xj4-fcmx-fcx8CGA-92gx-9vfq-hp9jCGA-97hr-9q93-qhgrCGA-c64r-74hc-f548CGA-c6hg-c7fv-5hwwCGA-cc3r-x5mw-wf5hCGA-cp73-2m55-f3g2CGA-fgjc-xpxr-32hqCGA-fmwh-x826-3q58CGA-fr4c-fwx2-74frCGA-g4xp-j78w-8r8fCGA-g53c-x3x6-j4v7CGA-g625-2q7m-fhjfCGA-g987-v8hc-g7prCGA-ghwr-phhc-7h6rCGA-gjvw-cxxq-qh47CGA-gprm-6m7f-r9mqCGA-h45j-jhh3-jmx2CGA-jh4m-3c6r-vcqrCGA-jhm3-75hg-xj77CGA-jrcc-qv8j-5qx8CGA-m4pf-hrxp-c3fxCGA-m86h-gp7q-5p2gCGA-p5p4-r865-jg3jCGA-p93p-rhxg-6q34CGA-pqqc-7853-376fGHSA-pc63-qcmh-9cmgCGA-qxv4-7q55-9w47CGA-r422-pxgr-793cCGA-r94q-7mmx-6c3hCGA-rhwv-274j-c24cCGA-rprr-c363-7242CGA-rr39-qgmp-45ghCGA-rrhw-3h48-46jmCGA-rvcw-pmg5-7cjpCGA-v3gx-vq64-xpchCGA-v6h6-x9c2-x4r3CGA-v865-86h9-5gv3CGA-vmpq-395q-883fCGA-vp2h-g7gj-fr73CGA-w3xg-rrpf-pc34CGA-w5jq-2w77-66rqCGA-w7vv-7jrq-j9hxCGA-wj5c-78f3-9j8pCGA-wpgh-h7q5-x7jpCGA-wx44-835v-8j75CGA-x385-95w4-v7w2CGA-x7v2-mg96-2hf7CGA-x96j-p5fx-7hg3CGA-x9c4-mg72-f5wh
Published 27-08-2026Last modified 27-08-2026
Vulnerability summary
CVE-2026-47884 is a critical (CVSS 9.8) Path Traversal vulnerability in spring spring framework. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.8% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
0.60%
0%100%
Low · +0.18 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 27-08-2026PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
CVSS metrics
7 scores · 7 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
+0.18 pp
From 0.42% on 18-09-2026
18-09-202618-10-2026
EPSS score0.60%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard38 products
- apache-activemq-5.19All versions (No fix recorded)
- apache-activemq-6.2All versions (No fix recorded)
- apache-activemq-6.3< 6.3.0-r4
- apache-activemq-fips-5.19All versions (No fix recorded)
- apache-activemq-fips-6.2All versions (No fix recorded)
Wolfi2 products
- thingsboard-tb-mqtt-transport< 4.3.1.5-r8 | All versions (No fix recorded)
- thingsboard-tb-node< 4.3.1.5-r8 | All versions (No fix recorded)
Debian1 product
- libspring-javaAll versions (No fix recorded)
Org.springframework1 product
- spring-webmvc≤ 5.2.25.RELEASE | ≥ 5.3.0, ≤ 5.3.49 | ≥ 6.0.0, ≤ 6.0.30 | ≥ 6.1.0, ≤ 6.1.28 | ≥ 6.2.0, ≤ 6.2.19 | ≥ 7.0.0, < 7.0.9
Spring1 product
- spring framework≥ 7.0.0, ≤ 7.0.8 | ≥ 6.2.0, ≤ 6.2.19 | ≥ 6.1.0, ≤ 6.1.28 | ≥ 6.0.0, ≤ 6.0.30 | ≥ 5.3.0, ≤ 5.3.49 | ≤ 5.2.25.RELEASE
Ubuntu1 product
- libspring-javaAll versions (No fix recorded)
Vmware1 product
- spring_framework< 5.2.26 | ≥ 5.3.0, < 5.3.50 | ≥ 6.0.0, < 6.0.31 | ≥ 6.1.0, < 6.1.29 | ≥ 6.2.0, < 6.2.20 | ≥ 7.0.0, < 7.0.8.1
7 vendors · 45 products
