CVE-2026-40987

Katalog CVE

CVSS 7.1 · High EPSS 0,26%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada vmware spring integration. Skor CVSS 3.1 7.1 (High) menurut vmware.com.

Deskripsi (NVD)

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

Rincian

Terbit di NVD

11 Juni 2026

Terakhir diubah

4 September 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber vmware.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://spring.io/security/cve-2026-40987 advisory vendor