CVE-2026-73244 kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileControllergetFiles to...

CVE-2026-73244

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileControllergetFiles to...

CVE-2026-73244 kkFileView: Unauthenticated path traversal in POST /listFiles allows arbitrary directory listing

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated POST /listFiles endpoint in server/src/main/java/cn/keking/web/controller/FileController.java passes the user-controlled path parameter from FileControllergetFiles to...

CVE-2026-73244

kkFileView (Spring Boot-based) prior to version 5.0.1 suffers an unauthenticated path traversal: the POST /listFiles endpoint forwards a user-controlled path param from FileController.getFiles to Files.newDirectoryStream without constraining to the demo directory, enabling directory enumeration o...

CLSA-2026-1785291684 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 77 org.springframework.boot packages to address 1 CVE. Fixed in 2.4.6-tuxcare.7...

CLSA-2026-1783904634 TuxCare security update for org.springframework.boot (6 CVEs)

TuxCare rebuilt 75 org.springframework.boot packages to address 6 CVEs. Fixed in 2.5.15-tuxcare.1...

CLSA-2026-1783991067 TuxCare security update for org.springframework.boot (11 CVEs)

TuxCare rebuilt 76 org.springframework.boot packages to address 11 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1...

CLSA-2026-1780620670 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 76 org.springframework.boot packages to address 1 CVE. Fixed in 2.7.16-tuxcare.5...

CLSA-2026-1778460303 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 77 org.springframework.boot packages to address 1 CVE. Fixed in 2.3.6.RELEASE-tuxcare.3...

CLSA-2026-1776299674 TuxCare security update for org.springframework.boot (2 CVEs)

TuxCare rebuilt 75 org.springframework.boot packages to address 2 CVEs. Fixed in 2.6.15-tuxcare.9...

CLSA-2026-1770336547 TuxCare security update for org.springframework.boot (2 CVEs)

TuxCare rebuilt 78 org.springframework.boot packages to address 2 CVEs. Fixed in 3.1.8-tuxcare.1...

CLSA-2025-1752019358 TuxCare security update for org.springframework.boot (5 CVEs)

TuxCare rebuilt 77 org.springframework.boot packages to address 5 CVEs. Fixed in 2.4.6.tuxcare.2...

CLSA-2025-1738627240 TuxCare security update for org.springframework.boot (1 CVE)

TuxCare rebuilt 76 org.springframework.boot packages to address 1 CVE. Fixed in 2.7.18.tuxcare.4...

Exploit for Code Injection in Vmware Spring_Framework

PoC Spring4Shell CVE-2022-22965 Proof of Concept per lo sfr...

CLEANSTART-2026-QG73743 Security fixes in spring-boot 3.5.13-r0

Package spring-boot version 3.5.13-r0 fixes 1 vulnerabilities: ghsa-j288-q9x7-2f5v...

CLEANSTART-2026-RA47496 Security fixes in spring-boot 3.4.13-r0

Package spring-boot version 3.4.13-r0 fixes 2 vulnerabilities: ghsa-4265-ccf5-phj5, ghsa-4g9r-vxhx-9pgx...

CVE-2026-59326

The CVE describes a disclosure risk in the Spring Boot language server: when creating an outbound HTTP client, it logs the raw value of https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variables at INFO level if no http.proxy workspace setting is configured. Proxy URLs often contain Basi...

CVE-2026-47858 live information startup mode is vulnerable for remote code execution

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Thei...

EUVD-2026-50970

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Thei...

A Bootiful Podcast: Spring Boot founder and lead Phil Webb

Hi, Spring fans! In this installment I talk to Spring Boot cofounder Phil Webb who joins the show to unpack the latest Spring Boot 4.1 release, from the long-awaited Spring gRPC support and MongoDB batch starter to security, observability, service connections, and other polished improvements...