Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Affected Packages

Maven org.springframework:spring-webflux

Affected versions: 6.1.0 (fixed in 6.1.14)

Maven org.springframework:spring-webmvc

Affected versions: 6.1.0 (fixed in 6.1.14)

Maven org.springframework:spring-webflux

Affected versions: 0 (last affected: 5.3.39)

Maven org.springframework:spring-webmvc

Affected versions: 0 (last affected: 5.3.39)

Maven org.springframework:spring-webflux

Affected versions: 6.0.0 (last affected: 6.0.23)

Maven org.springframework:spring-webmvc

Affected versions: 6.0.0 (last affected: 6.0.23)

Related CVEs

CVE-2024-38819

Key Information

GHSA ID

GHSA-g5vr-rgqm-vf78

Published

December 19, 2024 6:31 PM

Last Modified

May 28, 2025 2:22 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

org.springframework:spring-webflux

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 29, 2025 6:37 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.