CVE-2026-40982
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A directory traversal vulnerability in Spring Cloud Config allows attackers to access arbitrary files via a crafted URL. The issue affects the spring-cloud-config-server module serving text and binary files.
Risk Assessment
An attacker can read files outside the intended directory, potentially exposing sensitive configuration data or source code, leading to further compromise.
Recommendation
Upgrade Spring Cloud Config to version 3.1.14, 4.1.10, 4.2.7, 4.3.3, or 5.0.3 depending on your branch. Enterprise Support Only versions require a commercial subscription.
Original NVD description (English source)
Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.