Spring Cloud Config Server - Path Traversal

Spring Cloud 3.1.x 3.1.13, 4.1.x 4.1.9, 4.2.x 4.2.3, 4.3.x 4.3.2, and 5.0.x 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request. i...

ROOT-APP-MAVEN-CVE-2026-22739 CVE-2026-22739 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-22739 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

org.apereo.cas:cas-management-webapp (>=5.0.0.rc3, <=5.0.1), org.apereo.cas:cas-management-webapp-support (>=5.0.0.rc3, <=5.0.1) +103 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (1.2.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - org.apereo.cas:cas-management-webapp =5.0.0.rc3...

io.openexchange:configserver (1.0.3), org.apereo.cas:cas-management-webapp (>=5.0.2, <=5.0.10) +106 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (1.2.2.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - io.openexchange:configserver 1.0.3 -...

ai.hyacinth.framework:core-service-config-server (>=0.5.8, <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (2.1.1.release) +10 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (2.1.4.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - ai.hyacinth.framework:core-service-config-serve...

org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.3.0-rc1, <=5.3.0-rc3), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=5.3.0-rc4, <=5.3.16) +3 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (1.4.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

io.mosip.kernel:kernel-config-server (1.0.6), org.springframework.cloud.stream.app:spring-cloud-stream-app-starters-docs (>=darwin.release, <=darwin.sr1) +1 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (2.0.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - io.mosip.kernel:kernel-config-server 1.0.6 -...

org.springframework.cloud:spring-cloud-config-monitor (2.1.8.release) potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (2.1.8.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.microservices:cloud-altemistafwk-core-microservices-config-conf (3.1.0.release) +8 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (2.2.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

io.choerodon:choerodon-starter-config-monitor (>=0.5.0.release, <=0.6.4.release), org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.2.0, <=5.2.9) +2 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (1.3.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - io.choerodon:choerodon-starter-config-monitor...

CVE-2026-22739

creationtimestamp| type| source ---|---|--- 2026-03-24 01:30:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhrgha7cwp2s 2026-03-24 03:06:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhrlsidflx2i 2026-03-24 14:20:13+00:00| seen|...

io.github.ilyaslabs.foodstack:configserver (0.0.1), io.github.ilyaslabs:spring-boot-microservice-config-server (1.0.0) +9 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (>=4.3.0, <=4.3.1)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.3.0, =1.0.1, =7.3.0-rc2, =7.3.0-rc2, =26.01.01, =2.3.0, =4.3.0, =3.3.0, =3.3.1 - team.isaz.ark4test.cfgguard:config-guard-starter 1.0.0 - team.isaz.ark4test.cfgguard:config-guard-testkit 1.0.0 Source cves: CVE-2026-22739 Source...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +36 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.3.1)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =0.0.1, =1.0.0, =3.0.3, =0.5, =0.0.1, =0.1.41-beta, =1.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves: CVE-2026-22739 Source advisory:...

CVE-2021-22739

Information Exposure vulnerability exists in homeLYnk Wiser For KNX and spaceLYnk V2.60 and prior which could cause a device to be compromised when it is first configured...

Linux Distros Unpatched Vulnerability : CVE-2022-22739

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affects Firefox ESR 91.5,...

CVE-2025-22739

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through = 4.2.7.5...

CVE-2025-22739

creationtimestamp| type| source ---|---|--- 2025-03-27 22:36:54+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/9241 2025-03-28 01:01:21+00:00| seen| https://t.me/cvedetector/21354...

CVE-2025-22739

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through = 4.2.7.5...

CVE-2025-22739

CVE-2025-22739 affects LearnPress (WordPress LMS Plugin) up to version 4.2.7.5 and is a Missing Authorization vulnerability. The CVSS 3.1 score is 5.3 (Medium). Connected data confirm a patch exists for LearnPress, i.e., the issue has been addressed in a later release. Action: upgrade LearnPress ...

GPT Academic path traversal vulnerability (CNVD-2025-22739)

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a path traversal vulnerability that stems from an unverified 7z file extraction, which can be exploited by an attacker to perform arbitrary file writes, leadi...