CVE-2026-22739
HighSpring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access
Published Mar 24, 2026 · Updated Oct 8, 2026 · Also known as GHSA-3qwq-q9vm-5j42, ROOT-APP-MAVEN-CVE-2026-22739
Key Facts
Patch in the next maintenance window- CVE-2026-22739 is a high-severity vulnerability (CVSS 8.6 v3.1) affecting Spring Cloud Config (Vmware), org.springframework.cloud:spring-cloud-config-server (maven), seal.sp1.org.springframework.cloud:spring-cloud-config-server and 3 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 1.2% probability of exploitation in the next 30 days.
- Fixed versions are available, including io.root.org.springframework.cloud:spring-cloud-config-server 4.3.0-root.io.1, io.root.org.springframework.cloud:spring-cloud-config-server 4.3.0-root.io.2, org.springframework.cloud:spring-cloud-config-server 1.3.2.RELEASE+sp999.
- Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
CVSS v3.1
8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS (30-day exploit likelihood)
1.2%
Higher than 68.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-22739 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
Affected Products
8 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Cloud ConfigVmware | See advisory | 3.1.13 |
| org.springframework.cloud:spring-cloud-config-servermaven | >= 4.3.0 | 4.3.2 |
| seal.sp1.org.springframework.cloud:spring-cloud-config-serverseal | See advisory | 1.3.2.RELEASE+sp999 |
| seal.sp2.org.springframework.cloud:spring-cloud-config-serverseal | See advisory | 1.3.2.RELEASE+sp999 |
| io.root.org.springframework.cloud:spring-cloud-config-serverroot | See advisory | 4.3.0-root.io.1 |
Patched Releases
io.root.org.springframework.cloud:spring-cloud-config-server
4.3.0-root.io.1, 4.3.0-root.io.2
org.springframework.cloud:spring-cloud-config-server
1.3.2.RELEASE+sp999, 4.3.0-aikido.1, 4.3.0-aikido.2, 4.3.2, 5.0.2
seal.sp1.org.springframework.cloud:spring-cloud-config-server
1.3.2.RELEASE+sp999
seal.sp2.org.springframework.cloud:spring-cloud-config-server
1.3.2.RELEASE+sp999
Spring Cloud
3.1.13, 4.1.9, 4.2.3, 4.3.2, 5.0.2
Spring Cloud Config
3.1.13, 4.1.9, 4.2.6, 4.3.2, 5.0.2
Timeline
Publicly disclosed
Mar 24, 2026
Last updated
Oct 8, 2026
Weakness Type
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22739.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-22739
- articlehttps://github.com/spring-cloud/spring-cloud-config/commit/1870f07befd5f62edcfdaea5ad82441d0fd49912
- articlehttps://github.com/spring-cloud/spring-cloud-config/releases/tag/v4.3.2
FAQ
Common Questions.
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13,…
Affected: Spring Cloud Config (Vmware); org.springframework.cloud:spring-cloud-config-server (maven) versions >= 4.3.0; seal.sp1.org.springframework.cloud:spring-cloud-config-server, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including io.root.org.springframework.cloud:spring-cloud-config-server 4.3.0-root.io.1, io.root.org.springframework.cloud:spring-cloud-config-server 4.3.0-root.io.2, org.springframework.cloud:spring-cloud-config-server 1.3.2.RELEASE+sp999.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.
Is CVE-2026-22739 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo