CVE-2026-59280

Analyzed Analyzed - Analysis Complete

Path Traversal in Spring Framework via FreeMarker Integration

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VMware

Description

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59280

EUVD

EUVD-2026-67094

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_framework	From 6.2.0 (inc) to 6.2.20 (exc)
vmware	spring_framework	From 6.1.0 (inc) to 6.1.29 (exc)
vmware	spring_framework	From 5.3.0 (inc) to 5.3.50 (exc)
vmware	spring_framework	From 6.0.0 (inc) to 6.0.31 (exc)
vmware	spring_framework	to 5.2.26 (exc)
vmware	spring_framework	From 7.0.0 (inc) to 7.0.8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal attack in Spring Framework's FreeMarker integration. It occurs when an application returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Attackers can use backslash sequences in the view name to escape the configured template directory and access unauthorized files.

Detection Guidance

Check if your application uses Spring Framework's FreeMarker integration with view names derived from untrusted input. Inspect configuration for SpringTemplateLoader usage. Review logs for suspicious view names containing backslash sequences or path traversal patterns.

Impact Analysis

If exploited, this vulnerability could allow attackers to access sensitive files outside the intended template directory. This may lead to unauthorized data exposure, system compromise, or further attacks on the application or underlying infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Compliance may be impacted if the vulnerability results in data breaches or unauthorized disclosures.

Mitigation Strategies

Upgrade Spring Framework to a fixed version: 7.0.9 or later, 6.2.20 or later, 6.1.29 or later, 6.0.31 or later, or 5.3.50 or later. Avoid returning view names from untrusted input as per Spring documentation.

Hi! I’m here to help you understand CVE-2026-59280. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70