CVE-2025-41242
BaseFortify
Publication date: 2025-08-18
Last updated on: 2025-08-25
Assigner: VMware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| spring | spring_framework | * |
| spring | spring_framework | 6.1.22 |
| spring | spring_framework | 6.2.10 |
| spring | spring_framework | 5.3.44 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-41242 is a path traversal vulnerability in Spring Framework MVC applications that occurs when the application is deployed as a WAR file or with an embedded Servlet container that does not properly reject suspicious path sequences. This vulnerability affects applications serving static resources using Spring's resource handling. It allows attackers to potentially access unauthorized files or directories by exploiting improper URI path canonicalization in non-compliant Servlet containers. Verified safe deployments include Apache Tomcat and Eclipse Jetty with default security features enabled. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to perform a path traversal attack, potentially accessing sensitive files or resources on the server that should not be accessible. This can lead to unauthorized information disclosure, which may compromise the confidentiality of data served by the application. The impact is limited to confidentiality, with no direct impact on integrity or availability according to the CVSS score. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade your Spring Framework to a fixed version. Fixed versions include 5.3.44 (commercial), 6.1.22 (commercial), and 6.2.10 (open source). No additional mitigation steps beyond upgrading are necessary. Also, ensure that if you are using Apache Tomcat or Eclipse Jetty, their default security features remain enabled. [1]