PT-2026-27270 · Vmware · Spring Cloud

Hyunwoo Kim + 1 · Published 2026-03-23 · Updated 2026-04-01 · CVE-2026-22739

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Spring Cloud versions 3.1.X through 3.1.12, 4.1.X through 4.1.8, 4.2.X through 4.2.2, 4.3.X through 4.3.1, and 5.0.X through 5.0.1.

Description: A flaw exists in Spring Cloud Config when substituting the profile parameter from a request to the Spring Cloud Config Server configured to use the native file system as a backend. This allows an attacker to access files outside of the configured search directories. The issue is due to improper path restriction.

Recommendations: Update Spring Cloud to version 3.1.13, 4.1.9, 4.2.3, 4.3.2, or 5.0.2.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-04241

CVE-2026-22739

GHSA-3QWQ-Q9VM-5J42

Affected Products

Spring Cloud

References · 19

• https://bdu.fstec.ru/vul/2026-04241 · Security Note
• https://osv.dev/vulnerability/GHSA-3qwq-q9vm-5j42 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22739 · Security Note
• https://github.com/spring-cloud/spring-cloud-config · Note
• https://github.com/spring-cloud/spring-cloud-config/commit/1870f07befd5f62edcfdaea5ad82441d0fd49912 · Note
• https://github.com/spring-cloud/spring-cloud-config/releases/tag/v4.3.2 · Note
• https://github.com/spring-cloud/spring-cloud-config/releases/tag/v5.0.2 · Note
• https://twitter.com/TheHackerWire/status/2036254187017871413 · Twitter Post
• https://twitter.com/scandaletti/status/2036568925782286361 · Twitter Post
• https://twitter.com/v4bel/status/2039268612360622114 · Twitter Post
• https://spring.io/security/cve-2026-22739 · Note
• https://twitter.com/SirajD_Official/status/2037398217118413080 · Twitter Post
• https://twitter.com/aaappp75764701/status/2036704756111167584 · Twitter Post
• https://twitter.com/dsimelka/status/2038958513595261150 · Twitter Post
• https://twitter.com/CloudVirtues/status/2038108083512369424 · Twitter Post