CVE-2026-47887: Spring Framework Open Redirect in UrlFileNameViewController
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 5.2.25.RELEASE and earlier - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 5.3.0 - 5.3.49 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.0.0 - 6.0.30 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.1.0 - 6.1.28 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 6.2.0 - 6.2.19 - Upgrade
Upgrade
Spring Frameworkto a version that resolves this vulnerability.Fixed in 7.0.0 - 7.0.8
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Exposure requires a Spring MVC application that uses UrlFileNameViewController, maps it with an end-of-path pattern, and has no prefix configured. Applications that do not meet those conditions are not described as vulnerable.
Which Spring Framework versions are affected?
Affected releases are 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier.
What configuration should be reviewed if patching cannot happen immediately?
Review UrlFileNameViewController mappings for end-of-path patterns and determine whether a prefix is configured. The described vulnerable condition is an end-of-path mapping without a configured prefix.