CVE-2024-38816: Path traversal vulnerability in functional web frameworks
Spring · Spring
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. Specifically, an application is vulnerable when both of the following are true: * the web application uses RouterFunctions to serve static resources * resource handling is explicitly configured with a FileSystemResource location However, malicious requests are blocked and rejected when any of the following is true: * the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html is in use * the application runs on Tomcat or Jetty
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 39 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 7 days after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+7 days
- First seen exploitedVulnCheck KEV evidence+39 days
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
See the family tree12 related vulnerabilities in the same code over 3 months. The latest fix listed for spring-webmvc is 7.0.6.
Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.
- This CVECVE-2024-38816CVE-2024-38816: Path traversal vulnerability in functional web…13 Sep 2024
relatedHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Fixed one release later6.1.13 → 6.1.14 (org.springframework:spring-webmvc)
- Fixed one release later6.1.13 → 6.1.14 (org.springframework:spring-webflux)
- Same code patched: PathResourceLookupFunction.java, PathResourceLookupFunction.java (machine-matched)Functions: apply, isInvalidPathcommit d86bf8bcommit 3bfbe30commit fb7890d
- Similar weakness in the same product (machine-matched)same package + description similarity
10 more CVEs are in this family. See the family tree
Fixes in spring-webmvcMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 5.3.42CVE-2024-3882818 Nov 2024
- 6.0.7CVE-2023-2086027 Mar 2023
- 6.0.14CVE-2023-3405328 Nov 2023
- 6.1.13CVE-2024-3881613 Sep 2024
- 6.1.14CVE-2024-3881919 Dec 2024
- 6.2.10CVE-2025-4124218 Aug 2025
- 7.0.6CVE-2026-2273519 Mar 2026Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Mavenorg.springframework:spring-webmvcAffected: 6.1.0 up to 6.1.13; 6.0.0 through 6.0.23; 5.3.0 through 5.3.39Upgrade to 6.1.14 or later
- Mavenorg.springframework:spring-webfluxAffected: 6.1.0 up to 6.1.13; 6.0.0 through 6.0.23; 5.3.0 through 5.3.39Upgrade to 6.1.14 or later
What security researchers reported
Not named in any threat report yetAlso mentioned in 1 community threat pulse (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.