CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.
An application can be vulnerable when all the following are true:
the application is deployed as a WAR or with an embedded Servlet container the Servlet container does not reject suspicious sequences
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.springframework:spring-webmvcto a version that resolves this vulnerability.Fixed in 6.2.10 - Compensating control
If deployed on Apache Tomcat or Eclipse Jetty, ensure default security features are not disabled in the configuration, since applications were verified not vulnerable under those conditions (CVE-2025-41242).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41242?
CVE-2025-41242 has been classified with a high severity due to its potential to expose sensitive files in Spring Framework MVC applications.
How do I fix CVE-2025-41242?
To fix CVE-2025-41242, ensure that your application is deployed in a compliant Servlet container and properly validate user inputs.
Which applications are affected by CVE-2025-41242?
CVE-2025-41242 affects Spring Framework MVC applications deployed on non-compliant Servlet containers like Apache Tomcat and Eclipse Jetty.
What types of attacks can exploit CVE-2025-41242?
CVE-2025-41242 can be exploited through path traversal attacks, allowing attackers to access unauthorized file system locations.
Is CVE-2025-41242 relevant only to specific versions of Spring Framework?
CVE-2025-41242 is applicable to any version of Spring Framework that is deployed in a vulnerable configuration on a non-compliant Servlet container.