Path traversal in Spring Framework
Priority HIGH 72CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 fixed, 7 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.56463 99th percentileScored 2026-11-07
Fix Partial org.springframework:spring-webflux (Maven): 6.1.14org.springframework:spring-webmvc (Maven): 6.1.14Red Hat: 1 advisoryRed Hat: 1 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| N/A | Spring Framework | Spring Framework 5.3.0 - 5.3.40, 6.0.0 - 6.0.24, 6.1.0 - 6.1.13 | — | No fix listed | CNA |
| — | org.springframework:spring-webflux (Maven) | 6.1.0 to before 6.1.14 | 6.1.14 | Patch available | GHSA-g5vr-rgqm-vf78 |
| — | org.springframework:spring-webmvc (Maven) | 6.1.0 to before 6.1.14 | 6.1.14 | Patch available | GHSA-g5vr-rgqm-vf78 |
| — | org.springframework:spring-webflux (Maven) | up to 5.3.40 | — | No fix listed | GHSA-g5vr-rgqm-vf78 |
| — | org.springframework:spring-webmvc (Maven) | up to 5.3.40 | — | No fix listed | GHSA-g5vr-rgqm-vf78 |
| — | org.springframework:spring-webflux (Maven) | 6.0.0 – 6.0.24 | — | No fix listed | GHSA-g5vr-rgqm-vf78 |
| — | org.springframework:spring-webmvc (Maven) | 6.0.0 – 6.0.24 | — | No fix listed | GHSA-g5vr-rgqm-vf78 |
- Spring Framework VendorN/A Affected Spring Framework 5.3.0 - 5.3.40, 6.0.0 - 6.0.24, 6.1.0 - 6.1.13 Fixed in — No fix listed CNA
- org.springframework:spring-webflux (Maven) Vendor— Affected 6.1.0 to before 6.1.14 Fixed in 6.1.14 Patch available GHSA-g5vr-rgqm-vf78
- org.springframework:spring-webmvc (Maven) Vendor— Affected 6.1.0 to before 6.1.14 Fixed in 6.1.14 Patch available GHSA-g5vr-rgqm-vf78
- org.springframework:spring-webflux (Maven) Vendor— Affected up to 5.3.40 Fixed in — No fix listed GHSA-g5vr-rgqm-vf78
- org.springframework:spring-webmvc (Maven) Vendor— Affected up to 5.3.40 Fixed in — No fix listed GHSA-g5vr-rgqm-vf78
- org.springframework:spring-webflux (Maven) Vendor— Affected 6.0.0 – 6.0.24 Fixed in — No fix listed GHSA-g5vr-rgqm-vf78
- org.springframework:spring-webmvc (Maven) Vendor— Affected 6.0.0 – 6.0.24 Fixed in — No fix listed GHSA-g5vr-rgqm-vf78
Remediation
- Fix · GHSA-g5vr-rgqm-vf78 org.springframework:spring-webflux (Maven) Fixed in 6.1.14 Advisory →
- Fix · GHSA-g5vr-rgqm-vf78 org.springframework:spring-webmvc (Maven) Fixed in 6.1.14 Advisory →
Red Hat 1 advisory
- RHSA-2024:10700 Released 2024-12-02 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.8 for Spring Boot security update.
- Red Hat build of Apache Camel 4.8 for Spring Boot
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ Broker 7 | Affected | No fix planned: Will not fix |
| Red Hat Build of Keycloak | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel 4.8 for Spring Boot | Fixed | RHSA-2024:10700 |
Not affected: 8 products
- A-MQ Clients 2
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Single Sign-On 7
- Red Hat build of Apache Camel - HawtIO 4
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2024-38819
- 2026-10-03 Alias added: GHSA-g5vr-rgqm-vf78
References
Other 6
- https://spring.io/security/cve-2024-38819
- https://github.com/spring-projects/spring-framework/issues/33689
- https://github.com/spring-projects/spring-framework/commit/3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d
- https://github.com/spring-projects/spring-framework/commit/fb7890d73975a3d9e0763e0926df2bd0a608e87e
- https://github.com/spring-projects/spring-framework
- https://security.netapp.com/advisory/ntap-20250110-0010
Sources
- CVE-2024-38819 · CVE Program
- CVE-2024-38819 · NVD
- FIRST EPSS
- GHSA-g5vr-rgqm-vf78 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-38819 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences