{"id":"CVE-2026-22739","published":"2026-03-24T00:16:52Z","modified":"2026-03-24T14:40:53Z","title":"Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks","vendor":"Spring","product":"Spring Cloud","tier":"tail","description":{"text":"Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0122,"percentile":0.68573,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://spring.io/security/cve-2026-22739","tags":[]}],"priority":{"score":24.7,"factors":[{"name":"EPSS percentile","points":13.71},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.02}]},"exploitSources":{"nuclei":[{"id":"CVE-2026-22739","name":"Spring Cloud Config Server - Path Traversal","severity":"high","path":"http/cves/2026/CVE-2026-22739.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22739.yaml"}],"provenance":"source"},"vendorSlug":"spring","affectedVersions":[{"vendor":"Spring","product":"Spring Cloud","versions":[">= 3.1.x, < 3.1.13",">= 4.1.x, < 4.1.9",">= 4.2.x, < 4.2.3",">= 4.3.x, < 4.3.2",">= 5.0.x, < 5.0.2"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","vulnerableRanges":[">=4.3.0, <4.3.2",">=5.0.0-M1, <5.0.2",">=4.2.0, <=4.2.4",">=4.0.0, <=4.1.7","<=3.1.10"],"patched":["4.3.2","5.0.2"],"from":["GHSA-3qwq-q9vm-5j42"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-14664","exploited":false,"provenance":"source"}}