Spring Data Geode security vulnerability

Spring Data Geode is a software developed by Spring for configuring, operating, and accessing distributed data management systems. There is a security vulnerability in Spring Data Geode, which stems from the use of an insecure directory during the snapshot import process. Archives are stored in a...

PT-2026-20882

Name of the Vulnerable Software and Affected Versions Spring Data Geode affected versions not specified Description The software has a flaw related to insecure directory usage during snapshot imports. Specifically, archives are extracted into predictable and overly permissive directories within t...

CVE-2026-2817: Insertion of Sensitive Information into Externally-Accessible File or Directory

Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of...

Exploit for Expression Language Injection in Vmware Spring_Data_Mongodb

SpringData - SpEL RCE Exploit - CVE-2022-22980 Exploit pour l...

This Week in Spring - February 17th, 2026

Hi, Spring fans! Welcome to another rip-roaring installment of This Week in Spring! It's Lunar New Year or Chinese New Year for billions of people around the world and to those who celebrate, Happy Chinese/Lunar New Year 新年快乐! Or Happy Spring Festival 春节快乐! My favorite kind of festival! In honor ...

com.netflix.ndbench:ndbench-cli (>=0.3.12, <=0.7.4), com.netflix.ndbench:ndbench-geode-plugins (>=0.3.5, <=0.7.4) +4 more potentially affected by CVE-2026-23903 via org.apache.shiro:shiro-spring (1.3.1)

org.apache.shiro:shiro-spring MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-spring and may be impacted: - com.netflix.ndbench:ndbench-cli =0.3.12, =0.3.5, =0.7.4 - org.apache.shiro.samples:samples-sprhib 1.3...

org.springframework.data:spring-data-neo4j-aspects (2.0.0.release), org.springframework.data:spring-data-neo4j-cross-store (2.0.0.release) potentially affected by CVE-2026-1337 via org.neo4j:neo4j (1.6.m02)

org.neo4j:neo4j MAVEN version 1.6.m02 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.springframework.data:spring-data-neo4j-aspects 2.0.0.release - org.springframework.data:spring-data-neo4j-cross-store...

org.springframework.data:spring-data-neo4j-rest (1.0.0.release) potentially affected by CVE-2026-1337 via org.neo4j:neo4j (1.3)

org.neo4j:neo4j MAVEN version 1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.springframework.data:spring-data-neo4j-rest 1.0.0.release Source cves: CVE-2026-1337 Source advisory: OSV:GHSA-XR72-G735-4VWP...

org.springframework.data:spring-data-neo4j-rest (1.1.0.release) potentially affected by CVE-2026-1337 via org.neo4j:neo4j (1.4.1)

org.neo4j:neo4j MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.springframework.data:spring-data-neo4j-rest 1.1.0.release Source cves: CVE-2026-1337 Source advisory: OSV:GHSA-XR72-G735-4VWP...

org.neo4j.app:neo4j-server (1.8.3), org.neo4j.app:neo4j-server-advanced (1.8.3) +11 more potentially affected by CVE-2026-1337 via org.neo4j:neo4j (1.8.3)

org.neo4j:neo4j MAVEN version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.neo4j.app:neo4j-server 1.8.3 - org.neo4j.app:neo4j-server-advanced 1.8.3 - org.neo4j.app:neo4j-server-enterprise 1.8.3 -...

com.smb-tec.neo4j:neo4j-community (2.0.2), org.neo4j.app:neo4j-server (2.0.2) +11 more potentially affected by CVE-2026-1622 via org.neo4j:neo4j (2.0.2)

org.neo4j:neo4j MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - com.smb-tec.neo4j:neo4j-community 2.0.2 - org.neo4j.app:neo4j-server 2.0.2 - org.neo4j.app:neo4j-server-advanced 2.0.2 -...

org.springframework.data:spring-data-neo4j-rest (1.0.0.release) potentially affected by CVE-2026-1622 via org.neo4j:neo4j (1.3)

org.neo4j:neo4j MAVEN version 1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.springframework.data:spring-data-neo4j-rest 1.0.0.release Source cves: CVE-2026-1622 Source advisory: OSV:GHSA-4J3G-RWWQ-4P54...

org.springframework.data:spring-data-neo4j-aspects (2.0.0.release), org.springframework.data:spring-data-neo4j-cross-store (2.0.0.release) potentially affected by CVE-2026-1622 via org.neo4j:neo4j (1.6.m02)

org.neo4j:neo4j MAVEN version 1.6.m02 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.springframework.data:spring-data-neo4j-aspects 2.0.0.release - org.springframework.data:spring-data-neo4j-cross-store...

org.springframework.data:spring-data-neo4j-rest (1.1.0.release) potentially affected by CVE-2026-1622 via org.neo4j:neo4j (1.4.1)

org.neo4j:neo4j MAVEN version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j:neo4j and may be impacted: - org.springframework.data:spring-data-neo4j-rest 1.1.0.release Source cves: CVE-2026-1622 Source advisory: OSV:GHSA-4J3G-RWWQ-4P54...

This Week in Spring - January 20th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's already the 20th of January and we are off on yet another rip roarin' adventure as we look at the week that has been... this week in Spring! even more good stuff from Spring AI team legend Christian Tsolov, this one on...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

This Week in Spring – December 16th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! And what a week it’s been! We’ve got around nine shopping days ’til Christmas, and the New Year is almost here! Things are moving so quickly and the Spring community is no exception! Let's dive into this week's wonderful...

Exploit for Code Injection in Pivotal_Software Spring_Data_Commons

SpringBoot-Toolkit An interactive penetration-testing tool de...

Spring Data Ahead of Time Repositories - Part 2

Concluding the Road to GA blog post series, let's explore benefits of Spring Data AOT Repositories. Back in May 2025, we first introduced Ahead of Time AOT repositories as a preview feature for JPA and MongoDB with the 3rd Milestone of the next Spring Data generation. This feature, in short, uses...

This Week in Spring - November 18th, 2025

This Week in Spring - November 18th, 2025 Hi, Spring fans! I'm thrilled to be in New York City for an exciting week of joint presentations on Spring AI + Bedrock and Spring Boot with the legendary James Ward. First up: we'll present a workshop at the AI Native Dev Conf today, then speak at the...