CVE-2026-47862: ZipTransformer uses file_name header to build workDirectory path without sanitization
An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update ZipTransformer so the file_name header is not used to build the workDirectory path without sanitization; prevent path traversal so archives cannot be written outside the configured workDirectory.
ZipTransformer Use file_name header for archive path building = Sanitize/ignore unsanitized file_name when constructing workDirectory path
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Spring Integration's ZipTransformer with ZipResultType.FILE are exposed when an attacker can control the file_name message header on input reaching that transformer. ZipResultType.FILE is the default result type.
What access does an attacker need?
The attacker needs the ability to supply or influence the file_name header on a message processed by the vulnerable ZipTransformer. No user interaction is required.
Which Spring Integration versions are affected?
Affected versions are Spring Integration 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12.
What is the impact of successful exploitation?
A crafted file_name header can cause the generated .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. The stated impact includes low confidentiality and low integrity impact.