com.abiquo:commons-amqp (>=2.0.0, <=3.0.0), com.bluelock:camel-spring-amqp (>=1.0, <=1.2) +2 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (2.5.0)

com.rabbitmq:amqp-client MAVEN version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.abiquo:commons-amqp =2.0.0, =1.0, =2.1.0.release, =2.1.6.release Source cves: CVE-2026-69219 Source advisor...

org.graylog2:graylog2-inputs (>=0.21.0-beta2, <=0.92.0-beta.1), org.graylog2:graylog2-shared (>=0.21.0-beta2, <=0.92.0-beta.1) +2 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.2.4)

com.rabbitmq:amqp-client MAVEN version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.graylog2:graylog2-inputs =0.21.0-beta2, =0.21.0-beta2, =1.3.0.release, =1.3.2.release -...

com.bushidowallet:bushido-address-watcher (>=1.0.0, <=1.0.1), com.bushidowallet:bushido-wallet-service (>=1.0.0, <=1.0.1) +11 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (3.3.4)

com.rabbitmq:amqp-client MAVEN version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.bushidowallet:bushido-address-watcher =1.0.0, =1.0.0, =0.10.0, =3.0.0, =2.14.0, =2.2.0, =5.0.3,...

com.abiquo:commons-amqp (>=2.0.0, <=3.0.0), com.bluelock:camel-spring-amqp (>=1.0, <=1.2) +2 more potentially affected by CVE-2026-69220 via com.rabbitmq:amqp-client (2.5.0)

com.rabbitmq:amqp-client MAVEN version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.abiquo:commons-amqp =2.0.0, =1.0, =2.1.0.release, =2.1.6.release Source cves: CVE-2026-69220 Source advisor...

Directory Traversal

Spring Integration is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation of file paths received from malicious or compromised FTP/SFTP/SMB servers, which allows an attacker to write arbitrary content to files outside the configured local directory...

CLSA-2026-1785380362 TuxCare security update for org.springframework.integration (1 CVE)

TuxCare rebuilt 43 org.springframework.integration packages to address 1 CVE. Fixed in 6.4.10-tuxcare.1...

K000162431: Spring Integration vulnerability CVE-2026-40987

Security Advisory Description A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0...

CVE-2026-40987

A flaw was found in Spring Integration. A malicious or compromised FTP File Transfer Protocol, SFTP SSH File Transfer Protocol, or SMB Server Message Block server can exploit this vulnerability. This allows the server to write arbitrary files with attacker-controlled content to any location on th...

com.ahome-it:ahome-tooling-server-core (>=1.0.83-rc1, <=1.0.93-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.0.88-rc1, <=1.0.99-release) +6 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.1.5.release)

org.springframework.integration:spring-integration-file MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.ahome-it:ahome-tooling-server-core...

com.themodernway:themodernway-server-core (>=1.2.0-release, <=1.2.22-release), com.themodernway:themodernway-server-hazelcast (>=1.2.2-release, <=1.2.17-release) +46 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.12.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.themodernway:themodernway-server-cor...

org.springframework.cloud.stream.app:file-sink-kafka (1.0.4.release), org.springframework.cloud.stream.app:file-sink-rabbit (1.0.4.release) +18 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.2.11.release)

org.springframework.integration:spring-integration-file MAVEN version 4.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.integration:spring-integration-ftp (2.1.4.release), org.springframework.integration:spring-integration-sftp (2.1.4.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (2.1.4.release)

org.springframework.integration:spring-integration-file MAVEN version 2.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.integration:spring-integration-ftp (2.2.5.release), org.springframework.integration:spring-integration-sftp (2.2.5.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (2.2.5.release)

org.springframework.integration:spring-integration-file MAVEN version 2.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

com.javaetmoi.core:spring-batch-toolkit (>=1.0.0, <=1.0.1), net.gplatform:sudoor-server-lib (1.0.13) +3 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.1.1.release)

org.springframework.integration:spring-integration-file MAVEN version 4.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.javaetmoi.core:spring-batch-toolkit...

org.springframework.integration:spring-integration-ftp (2.0.1.release), org.springframework.integration:spring-integration-sftp (2.0.1.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (2.0.1.release)

org.springframework.integration:spring-integration-file MAVEN version 2.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

com.ahome-it:ahome-tooling-server-core (>=1.1.15-release, <=1.1.26-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.15-release, <=1.1.25-release) +41 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.4.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.ahome-it:ahome-tooling-server-core...

org.springframework.integration:spring-integration-ftp (2.1.2.release), org.springframework.integration:spring-integration-sftp (2.1.2.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (2.1.2.release)

org.springframework.integration:spring-integration-file MAVEN version 2.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

com.clusterra:clusterra-pmbok-plan (>=1.0.6.release, <=1.0.14.release), com.clusterra:pmbok-plan (>=1.0.1.release, <=1.0.5.release) +2 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.1.3.release)

org.springframework.integration:spring-integration-file MAVEN version 4.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: - com.clusterra:clusterra-pmbok-plan...

org.springframework.boot:spring-boot-starter-integration (1.3.6.release), org.springframework.integration:spring-integration-ftp (4.2.8.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.2.8.release)

org.springframework.integration:spring-integration-file MAVEN version 4.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.integration:spring-integration-ftp (4.0.0.release), org.springframework.integration:spring-integration-sftp (4.0.0.release) potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.0.0.release)

org.springframework.integration:spring-integration-file MAVEN version 4.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...