CLEANSTART-2026-IK05706 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect

🗓️ 08 Oct 2026 00:43:15Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Open redirect in apache-nifi-registry via UrlFileNameViewController.

Reporter	Title	Published	Views	Family All 105
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	8 Sep 202615:02	–	ibm
IBM Security Bulletins	Security Bulletin: DEV-EXT - spring-webmvc-6.2.19.jar (Publicly disclosed vulnerability found by Scanner)	17 Sep 202620:40	–	ibm
IBM Security Bulletins	Security Bulletin: As an Spring MVC application, IBM Sterling Control Center is vulnerable to Path Traversal, Open Redirect and CRLF Injection (CVE-2026-47884, CVE-2026-47887, CVE-2026-47890)	5 Oct 202619:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	8 Sep 202615:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for Sept 2026 - Multiple CVEs addressed	1 Oct 202606:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	11 Sep 202616:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	9 Sep 202601:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring	9 Sep 202601:28	–	ibm
CVE	CVE-2026-47887	27 Aug 202605:21	–	cve
Cvelist	CVE-2026-47887 Spring Framework Open Redirect in UrlFileNameViewController	27 Aug 202605:21	–	cvelist

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IK05706.json
osv	www.osv.dev/vulnerability/CVE-2026-47887
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-47887

08 Oct 2026 01:30Current

CVSS 3.16.1

EPSS0.0024

apache-nifi-registry UrlFileNameViewController open redirect