332 matches found
org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc2), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc2) +3 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.1)
org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.1 Source cves: CVE-2026-22739 Source advisory: OSV:GHSA-3QWQ-Q9VM-5J42...
GHSA-3QWQ-Q9VM-5J42 Spring Cloud Config Server: Path Traversal via Profile Parameter Allows Arbitrary File Access
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from...
cn.ipokerface:spring-cloud-config-server (1.0.0), com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (2.2.1.release) +26 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (2.2.2.release)
org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - cn.ipokerface:spring-cloud-config-server 1.0.0 ...
CVE-2026-22739
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from...
CVE-2026-22739 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from...
org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc2), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc2) +3 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.1)
org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.1 Source cves: CVE-2026-22739 Source advisory: MEND:CVE-2026-22739...
io.github.ilyaslabs.foodstack:configserver (0.0.1), io.github.ilyaslabs:spring-boot-microservice-config-server (1.0.0) +9 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (>=4.3.0, <=4.3.1)
org.springframework.cloud:spring-cloud-config-server MAVEN version =4.3.0, =1.0.1, =7.3.0-rc2, =7.3.0-rc2, =26.01.01, =2.3.0, =4.3.0, =3.3.0, =3.3.1 - team.isaz.ark4test.cfgguard:config-guard-starter 1.0.0 - team.isaz.ark4test.cfgguard:config-guard-testkit 1.0.0 Source cves: CVE-2026-22739 Source...
CVE-2026-22739
Spring Cloud Config Server with native-file-system backend is vulnerable to an issue in profile substitution that can cause access to files outside configured search directories, leading to potential SSRF/unauthorized file reads. Affected lines: Spring Cloud 3.1.x before 3.1.13; 4.1.x before 4.1....
CVE-2026-22739: Improper Limitation of a Pathname to a Restricted Directory
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from...
PT-2026-27270
Name of the Vulnerable Software and Affected Versions: Spring Cloud versions 3.1.X through 3.1.12, 4.1.X through 4.1.8, 4.2.X through 4.2.2, 4.3.X through 4.3.1, and 5.0.X through 5.0.1. Description: A flaw exists in Spring Cloud Config when substituting the profile parameter from a request to th...
com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +38 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.3.1)
org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =0.0.1, =1.0.0, =3.0.3, =0.5, =0.0.1, =0.1.41-beta, =1.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves: CVE-2026-22739 Source advisory:...
org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc2), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc2) +3 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.1)
org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.1 Source cves: CVE-2026-22739 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-15762281...
com.revinate:henicea (>=1.0.0, <=1.1.2), de.codecentric:spring-boot-starter-batch-web (1.3.5.release) +20 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.2.4.release)
org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.revinate:henicea =1.0.0, =0.15.4, =0.15.4...
net.acesinc:convergent-ui (>=1.0.4, <=1.0.6), org.apache.camel:camel-example-spring-boot (2.16.0) +6 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.2.6.release)
org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - net.acesinc:convergent-ui =1.0.4, =1.0.6 -...
com.netflix.spectator:spectator-web-spring (>=0.41.0, <=0.42.0), org.apache.camel:camel-example-spring-boot (>=2.16.3, <=2.16.5) +8 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.2.8.release)
org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.netflix.spectator:spectator-web-spring...
cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +90 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.2.5.release)
org.springframework.security:spring-security-web MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1,...
cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +183 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.4.23.final)
io.undertow:undertow-core MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.5.12, =1.5.12, =1.5.16, =1.5.12...
cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +183 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.4.23.final)
io.undertow:undertow-core MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.5.12, =1.5.12, =1.5.16, =1.5.12...
cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +183 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.4.23.final)
io.undertow:undertow-core MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.5.12, =1.5.12, =1.5.16, =1.5.12...
