Summaryinfo

A vulnerability categorized as critical has been discovered in VMware Spring Cloud up to 3.1.12/4.1.8/4.2.2/4.3.1/5.0.1. The impacted element is an unknown function of the component File System Handler. Executing a manipulation can lead to Remote Code Execution. This vulnerability is tracked as CVE-2026-22739. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in VMware Spring Cloud up to 3.1.12/4.1.8/4.2.2/4.3.1/5.0.1. This vulnerability affects an unknown functionality of the component File System Handler. The manipulation with an unknown input leads to a remote code execution vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.

The advisory is shared for download at spring.io. This vulnerability was named CVE-2026-22739 since 01/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/28/2026). The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 3.1.13, 4.1.9, 4.2.3, 4.3.2 or 5.0.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• VMware

Name

• Spring Cloud

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.1.7
• 3.1.8
• 3.1.9
• 3.1.10
• 3.1.11
• 3.1.12
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.1.8
• 4.2.0
• 4.2.1
• 4.2.2
• 4.3.0
• 4.3.1
• 5.0.0
• 5.0.1

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion