CVE-2026-40987

Name of the Vulnerable Software and Affected Versions Spring Integration versions 7.0.0 through 7.0.4 Spring Integration versions 6.5.0 through 6.5.8 Spring Integration versions 6.4.0 through 6.4.11 Spring Integration versions 6.3.0 through 6.3.14 Spring Integration versions 5.5.0 through 5.5.20

Description The remote-file synchronizer fails to perform canonicalization on server-supplied filenames. This allows a malicious or compromised FTP, SFTP, or SMB server to write arbitrary files with attacker-controlled content to any location on the client filesystem, bypassing the configured local-directory restriction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.