5.9
Moyenne
CVE-2026-22737 Use of Java scripting engine enabled (e.g
Description
Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Framework 7.0 | 7.0.0 → 7.0.5 | Pas de correctif indiqué |
| Spring Framework 6.2 | 6.2.0 → 6.2.16 | Pas de correctif indiqué |
| Spring Framework 6.1 | 6.1.0 → 6.1.25 | Pas de correctif indiqué |
| Spring Framework 5.3 | 5.3.0 → 5.3.46 | Pas de correctif indiqué |
Autres CVE de Spring Framework
Les 45 CVE de Spring Framework →
CVE-2026-59314
Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response…
3.7
Faible
CVE-2026-59313
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent…
9.8
Critique
CVE-2026-59283
Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable…
9.1
Critique
CVE-2026-59282
Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a…
7.5
Élevée