CVE-2026-47862

Analyzed Analyzed - Analysis Complete

Path Traversal in Spring Integration

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VMware

Description

An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47862

EUVD

EUVD-2026-66827

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_integration	From 6.4.0 (inc) to 6.4.13 (exc)
vmware	spring_integration	From 6.5.0 (inc) to 6.5.11 (exc)
vmware	spring_integration	From 7.0.0 (inc) to 7.0.5.1 (exc)
vmware	spring_integration	From 7.1.0 (inc) to 7.1.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in Spring Integration's ZipTransformer. An attacker who can set the file_name header on a message can manipulate the resulting .zip archive to be written to any filesystem path outside the configured workDirectory. This happens because the file_name header is used to construct the workDirectory path when ZipResultType.FILE is set, which is the default setting.

Detection Guidance

To detect this vulnerability, check if your Spring Integration version is within the affected ranges (6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, or 7.1.0). Verify if ZipTransformer with ZipResultType.FILE is used and if file_name headers are processed. Inspect logs for unexpected file writes outside the workDirectory.

Impact Analysis

An attacker could exploit this to write malicious .zip files to arbitrary locations on the filesystem. This could lead to unauthorized file creation, overwriting existing files, or placing files in sensitive directories. The impact depends on the permissions of the application running Spring Integration.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file writes outside intended directories. An attacker exploiting this could place sensitive data in unintended locations, risking data leaks or unauthorized access. This may violate principles of data integrity, confidentiality, and controlled access required by these regulations.

Mitigation Strategies

Upgrade to fixed versions: 7.1.0.1 (Enterprise Support only), 7.1.1 (OSS), 7.0.5.1 (Enterprise Support only), 7.0.6 (OSS), 6.5.11 (Enterprise Support only), or 6.4.13 (Enterprise Support only). No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-47862. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70