CVE-2026-47884: Spring Framework Improper Path Limitation in XsltView
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 5.2.25.RELEASE - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 5.3.0 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.0.0 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.1.0 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.2.0 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 7.0.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
A Spring MVC application is exposed when it uses XsltView and has an "/**" mapping that results in view rendering while the view name is not explicitly specified.
What must an attacker be able to do to exploit the issue?
The vulnerable conditions require a request path that is handled by the broad "/**" mapping and reaches XsltView rendering without an explicitly specified view name. Under those conditions, the issue can lead to SSRF and remote code execution.
Are applications using XsltView affected by default?
The data identifies additional required configuration conditions beyond using XsltView: an "/**" mapping must result in view rendering, and the view name must not be explicitly specified. The provided information does not establish that this configuration is enabled by default.
Which Spring Framework versions are affected?
Affected versions are 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier.