What’s Vulnerable › Vulnerabilities

CVE-2024-38819: Spring Framework Path Traversal vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 56.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-12-19 · updated 2026-06-17
• Weakness: CWE-22

Description

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Affected products

• Maven Org.Springframework:Spring-Webflux: from 6.1.0 before 6.1.14; through 5.3.40; from 6.0.0 through 6.0.24; 6.1.0, 6.1.1, 6.1.10, 6.1.11, 6.1.12, 6.1.13 (+140) — fixed in 6.1.14
• Maven Org.Springframework:Spring-Webmvc: from 6.1.0 before 6.1.14; through 5.3.40; from 6.0.0 through 6.0.24; 6.1.0, 6.1.1, 6.1.10, 6.1.11, 6.1.12, 6.1.13 (+282) — fixed in 6.1.14
• Spring Framework: from Spring Framework 5.3.0 through 5.3.40, 6.0.0 - 6.0.24, 6.1.0 - 6.1.13

How to fix

Upgrade to a fixed version: Maven Org.Springframework:Spring-Webflux 6.1.14; Maven Org.Springframework:Spring-Webmvc 6.1.14. Check the vendor advisory for mitigations.

References

• https://spring.io/security/cve-2024-38819
• https://security.netapp.com/advisory/ntap-20250110-0010/

Get alerted when CVE-2024-38819 or the next vulnerability affects your stack