High

Path Traversal in Spring Cloud Config Server profile parameter

IdentifiersCVE-2026-22739CWE-22· Improper Limitation of a Pathname…

CVE-2026-22739 is a path traversal vulnerability in Spring Cloud Config Server arising from substitution of the request-supplied profile parameter. When the Config Server is configured to use the native file system backend, improper handling of the profile value can allow access to files outside the configured search directories. The provided content also states that, when a source control backend is used, the profile parameter could be substituted into the repository URL, making server-side request forgery (SSRF) attacks possible. Affected versions are Spring Cloud 3.1.x before 3.1.13, 4.1.x before 4.1.9, 4.2.x before 4.2.3, 4.3.x before 4.3.2, and 5.0.x before 5.0.2.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can allow an unauthenticated remote attacker to read unintended files outside the configured search directories when the native file system backend is in use, exposing sensitive configuration or other local files. The supplied content also indicates low integrity and availability impact in the CVSS vector, and notes that with a source control backend the same profile substitution issue may enable SSRF by influencing the URL used to access the source control repository.

Mitigation

If you can’t patch tonight, do this now.

No vendor workaround is provided in the supplied content. Until patched, reduce exposure by restricting network access to Spring Cloud Config Server to trusted clients only, avoid public Internet exposure, and review deployments using the native file system backend or source control backends where profile substitution may influence backend paths or URLs.

Remediation

Patch, then assume compromise.

Upgrade Spring Cloud Config Server to a fixed version: 3.1.13 or later in the 3.1.x line, 4.1.9 or later in the 4.1.x line, 4.2.3 or later in the 4.2.x line, 4.3.2 or later in the 4.3.x line, or 5.0.2 or later in the 5.0.x line.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

BroadcomSpring Cloudapplication

BroadcomSpring Cloud Configapplication

BroadcomSpring Cloud Config Serverapplication

SpringSpring Cloudapplication

SpringSpring Cloud Config Serverapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

11 SOURCESView more in app

nuclei templates pull requestsNews

Mar 29, 2026

Add Spring Cloud Config Server - Path Traversal via Profile Parameter by Akokonunes · Pull Request #15719 · projectdiscovery/nuclei-templates · GitHub

A path traversal vulnerability in Spring Cloud Config Server.

ca ccsNews

Mar 26, 2026

Spring security advisory (AV26-288) - Canadian Centre for Cyber Security

A vulnerability in Spring Cloud Config involving profile substitution that can allow unintended file access and enable SSRF attacks.

cvefeed high severityNews

Mar 24, 2026

CVE-2026-22739 - Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks

A vulnerability in Spring Cloud Config Server using the native file system backend that allows access to files outside the configured search directories via profile parameter substitution.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity6

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-22739

NVD

nvd.nist.gov/vuln/detail/CVE-2026-22739

MITRE CWE · CWE-22

Improper Limitation of a Pathname to a…

spring.io

spring.io/security/cve-2026-22739