CVE-2026-59280

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.8 Spring Framework versions 6.2.0 through 6.2.19 Spring Framework versions 6.1.0 through 6.1.28 Spring Framework versions 6.0.0 through 6.0.30 Spring Framework versions 5.3.0 through 5.3.49 Spring Framework versions prior to 5.2.25.RELEASE

Description Applications using the FreeMarker integration are susceptible to a path traversal attack. This occurs when a controller returns a view name derived from untrusted input while FreeMarker is configured to resolve templates through the SpringTemplateLoader. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

Recommendations Update Spring Framework to a version later than 7.0.8. Update Spring Framework to a version later than 6.2.19. Update Spring Framework to a version later than 6.1.28. Update Spring Framework to a version later than 6.0.30. Update Spring Framework to a version later than 5.3.49. Update Spring Framework to a version later than 5.2.25.RELEASE.