Path Traversal in Spring Cloud Gateway

Executive Summary

CVE-2026-47879 is a vulnerability in Spring Cloud Gateway where the JsonToGrpcGatewayFilterFactory component allows arbitrary Spring Resource locations for defining the proto descriptor. This can lead to Server-Side Request Forgery (SSRF) and native file access via gRPC, enabling attackers to access internal resources or files.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Spring Cloud Gateway version falls within the affected ranges (5.0.0-5.0.2, 4.3.0-4.3.5, 4.0.0-4.2.9, or 3.1.13 and earlier). Inspect configuration files for JsonToGrpcGatewayFilterFactory usage and verify if arbitrary resource locations are allowed for proto descriptors.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to perform SSRF attacks, accessing internal systems or files on the server. It may also lead to unauthorized data exposure or manipulation if file access is exploited. Systems using vulnerable versions of Spring Cloud Gateway are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Unauthorized access to sensitive files or systems may result in non-compliance, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to fixed versions: 5.0.3 (OSS), 4.3.6 (Enterprise), 4.2.10 (Enterprise), or 3.1.14 (Enterprise). For file-based resources, configure valid proto descriptor prefixes using spring.cloud.gateway.server.webflux.json-to-grpc.valid-proto-descriptor-prefixes (5.0.x/4.3.x) or spring.cloud.gateway.json-to-grpc.valid-proto-descriptor-prefixes (4.2.x/3.1.x) to restrict access.

Useful 0 Not Useful 0