CVE-2025-41242
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-18

Last updated on: 2025-08-25

Assigner: VMware

Description
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-18
Last Modified
2025-08-25
Generated
2026-05-27
AI Q&A
2025-08-18
EPSS Evaluated
2026-05-25
NVD
EUVD
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
spring spring_framework *
spring spring_framework 6.1.22
spring spring_framework 6.2.10
spring spring_framework 5.3.44
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

CVE-2025-41242 is a path traversal vulnerability in Spring Framework MVC applications that occurs when the application is deployed as a WAR file or with an embedded Servlet container that does not properly reject suspicious path sequences. This vulnerability affects applications serving static resources using Spring's resource handling. It allows attackers to potentially access unauthorized files or directories by exploiting improper URI path canonicalization in non-compliant Servlet containers. Verified safe deployments include Apache Tomcat and Eclipse Jetty with default security features enabled. [1]


How can this vulnerability impact me? :

This vulnerability can allow an attacker to perform a path traversal attack, potentially accessing sensitive files or resources on the server that should not be accessible. This can lead to unauthorized information disclosure, which may compromise the confidentiality of data served by the application. The impact is limited to confidentiality, with no direct impact on integrity or availability according to the CVSS score. [1]


What immediate steps should I take to mitigate this vulnerability?

The immediate step to mitigate this vulnerability is to upgrade your Spring Framework to a fixed version. Fixed versions include 5.3.44 (commercial), 6.1.22 (commercial), and 6.2.10 (open source). No additional mitigation steps beyond upgrading are necessary. Also, ensure that if you are using Apache Tomcat or Eclipse Jetty, their default security features remain enabled. [1]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart