CVE-2026-47887 in Spring
Summary
by MITRE • 08/27/2026
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in the Spring MVC framework affects applications utilizing the UrlFileNameViewController component, specifically when this controller is mapped to an end-of-path pattern without a configured prefix. This configuration creates a scenario where user-supplied input within the URL path segment is directly reflected into HTTP redirect responses without adequate validation or sanitization. The core technical flaw lies in the lack of strict boundary checking for the target location parameter, allowing attackers to craft malicious URLs that instruct the browser to navigate away from the trusted domain to an arbitrary external site. This behavior constitutes a classic open redirect vulnerability, which is categorized under CWE-601: URL Redirection to Untrusted Site (Open Redirect) in standard security classification systems.
From an operational perspective, this flaw can be exploited by threat actors to facilitate phishing attacks where victims are lured into clicking links that appear legitimate but ultimately lead to malicious domains designed to steal credentials or deliver malware. Additionally, open redirects can be used for cross-site request forgery amplification or as a vector for session hijacking if combined with other vulnerabilities such as insecure cookie handling. The impact is particularly severe in enterprise environments where the application serves as an entry point for sensitive services, as trust relationships established through domain reputation are undermined by the ability to redirect users outside of controlled boundaries.
The affected versions span multiple major releases of the Spring Framework, including 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, and 5.3.0 through 5.3.49, as well as Spring Framework 5.2.25.RELEASE and earlier versions. This wide range of affected software indicates that the issue persists across different architectural iterations unless specific mitigations are applied by developers or administrators. The vulnerability aligns with ATT&CK technique T1566.002: Spearphishing Link, as it enables attackers to disguise malicious links behind trusted domains, thereby increasing the likelihood of successful social engineering campaigns against end users.
To mitigate this risk, organizations should immediately upgrade to a patched version of the Spring Framework that addresses the UrlFileNameViewController logic flaw. For applications where upgrading is not feasible in the short term, developers can implement custom validation logic within their controllers or filters to ensure that any redirect targets are strictly validated against an allowlist of trusted domains. Alternatively, configuring a prefix for the UrlFileNameViewController mapping restricts the scope of path segments processed by the controller, thereby reducing the attack surface. Security teams should also monitor web server logs for unusual patterns of outbound redirects originating from affected endpoints and consider implementing Content Security Policy headers that restrict navigation to unauthorized origins where applicable.