Description

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T06:17:18.507Z",
  "pubdate": "2026-08-27T06:17:18.507Z",
  "executiveSummary": "A vulnerability exists within the XsltView component of the Spring Framework, enabling Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE).\nThe flaw manifests in configurations where Spring MVC employs a broad '/**' mapping that triggers view rendering without an explicit view name, allowing attackers to influence the view resolution process.\nAffected products include Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.\nThis vulnerability poses a critical risk, as it allows unauthenticated remote attackers to manipulate the XSLT transformation process, potentially leading to arbitrary file access or the execution of malicious code on the host server.\nThe risk is exacerbated by the commonality of the vulnerable configuration pattern, which leaves applications exposed if they rely on dynamic view names derived from user-controlled request parameters.",
  "technicalDetails": "The vulnerability resides in the interaction between Spring MVC's view resolution mechanism and the XsltView class, which is designed to perform XSLT transformations on XML documents.\nThe root cause is improper sanitization and validation of the view name when the application is configured with a catch-all '/**' URL mapping. In such scenarios, if the application controller returns a view name implicitly or allows it to be derived from user-supplied input, an attacker can manipulate the view resolution path.\nWhen XsltView is invoked, it attempts to load an XSLT stylesheet from a URI. If the view name is not explicitly constrained, an attacker can supply a malicious URI or path that the application then attempts to process as a stylesheet.\nIn the context of SSRF, the attacker can force the server to fetch a malicious XSLT file from an external or internal resource. If the XSLT processor is not configured to disable external entity expansion or script execution, the processing of this malicious file can trigger further exploitation.\nThe transition to RCE occurs because the XSLT engine can be leveraged to execute arbitrary system commands or perform object injection through various XSLT extension mechanisms. By providing a crafted XSLT payload, an attacker can achieve code execution under the context of the Java Virtual Machine running the Spring application.\nThe exploitation flow typically begins with an attacker identifying an endpoint that delegates view name resolution to the request path. By injecting a crafted parameter or path component that maps to a malicious resource—such as a remote URL or a local file path containing the payload—the attacker forces the XsltView resolver to instantiate a transformer using untrusted content.\nThis behavior is highly dangerous because it bypasses standard authorization checks at the controller level, as the malicious processing occurs during the view resolution phase of the Request-Response lifecycle.\nThe vulnerability is present across a wide range of legacy and modern Spring versions, highlighting a long-standing architectural risk in how Spring MVC handles dynamic view rendering for XSLT-based templates."
}