8.6
Élevée
CVE-2026-22739 Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config…
Description
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Cloud 5.0 | 5.0.x → < 5.0.2 | 5.0.2 |
| Spring Cloud 4.3 | 4.3.x → < 4.3.2 | 4.3.2 |
| Spring Cloud 4.2 | 4.2.x → < 4.2.3 | 4.2.3 |
| Spring Cloud 4.1 | 4.1.x → < 4.1.9 | 4.1.9 |
| Spring Cloud 3.1 | 3.1.x → < 3.1.13 | 3.1.13 |