CVE-2026-59280: Spring Framework Path Traversal via Backslash in SpringTemplateLoader
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications may be exposed if they use Spring Framework's FreeMarker integration, configure FreeMarker to resolve templates through SpringTemplateLoader, and allow a controller's view name to be derived from untrusted input.
What does an attacker need to exploit the vulnerability?
An attacker needs influence over a controller-returned view name through untrusted input. The vulnerable application must also use SpringTemplateLoader for FreeMarker template resolution.
Are applications using FreeMarker affected by default?
The provided information identifies a specific affected configuration: FreeMarker must be configured to resolve templates through SpringTemplateLoader. It does not establish that all FreeMarker or all Spring Framework deployments are affected.
Which Spring Framework versions are listed as affected?
The affected ranges are 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier.