CVE-2026-47884
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. This affects a wide range of Spring Framework versions.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code on the server or perform SSRF attacks, potentially leading to full system compromise.
Recommendation
Update Spring Framework to the latest patched version. Additionally, avoid using XsltView with implicit view names and restrict "/**" mappings.
Original NVD description (English source)
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier