CVE-2026-40985
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Applications that configure WebFlowELExpressionParser are vulnerable to malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0, 3.0.0-3.0.1, and 2.5.0-2.5.1.
Risk Assessment
The organization is at risk of remote code execution (RCE) via malicious EL expression injection, which could lead to full server compromise.
Recommendation
Immediately upgrade Spring Web Flow to version 4.0.1 or later (if available) or apply temporary WAF rules to block suspicious EL expressions.
Other vulnerabilities in Spring Web Flow
See all- CVE-2017-4971Medium
An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property (disabled by default) can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.
- CVE-2026-40986Medium
Vulnerability in Spring Web Flow where the JavaScript RemotingHandler renders the error response body as HTML even when the response is not 'text/html'. This can lead to a scripting attack in the user's browser if the error response contains attacker-reflected data. Affects versions 4.0.0, 3.0.0-3.0.1, 2.5.0-2.5.1.
- CVE-2017-8039Medium
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property (disabled by default) can be vulnerable to malicious EL expressions in view states that process form submissions without explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.
Original NVD description (English source)
Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.