Description

A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-27T06:17:19.310Z",
  "pubdate": "2026-08-27T06:17:19.310Z",
  "executiveSummary": "A critical open redirect vulnerability exists in the Spring Framework's UrlFileNameViewController. This vulnerability arises when the controller is mapped with an end-of-path pattern and lacks a configured prefix, allowing an attacker to manipulate the URL path to redirect users to arbitrary, potentially malicious, external domains.\nThe vulnerability affects multiple versions of the Spring Framework, including the 5.2.x, 5.3.x, 6.0.x, 6.1.x, 6.2.x, and 7.0.x branches.\nImpact includes potential phishing attacks, bypassing cross-site scripting (XSS) protections, or credential theft by tricking users into visiting malicious websites while appearing to interact with a trusted domain. The attack requires no authentication and can be executed over a network by crafting a specific request to the application. Mitigation is essential to prevent unauthorized redirection and maintain the integrity of user navigation.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of request paths within the UrlFileNameViewController component of the Spring MVC framework. This controller is designed to resolve view names based on the request URI path. When the controller is mapped using a pattern that ends at the path, such as '/*', and specifically when the internal 'prefix' property is not explicitly configured, the controller fails to properly validate or sanitize the input used to determine the destination view.\nIn a standard implementation, UrlFileNameViewController extracts the filename from the request path and resolves it to a view. When the prefix is absent, the mechanism for constructing the redirect URI is susceptible to path traversal or manipulation techniques. An attacker can supply a specially crafted request URI that incorporates a protocol-relative URL or an absolute URL. Because the framework does not sanitize the resolved path, it may interpret the manipulated input as a valid redirection target.\nThe exploitation flow begins with an attacker identifying an application endpoint managed by UrlFileNameViewController. By crafting a URL that forces the controller to interpret the input as an external URI rather than an internal view path—often utilizing techniques like protocol manipulation (e.g., 'http://' or '//' prefixes)—the attacker induces the application to issue an HTTP response with a Location header pointing to the attacker-controlled destination. Because the vulnerability lies within the framework's logic for processing request mappings, it is accessible over the network without requiring prior authentication or specific user privileges.\nThe affected versions include Spring Framework 5.2.25.RELEASE and earlier, 5.3.0 through 5.3.49, 6.0.0 through 6.0.30, 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. The post-exploitation impact allows attackers to weaponize the trusted domain to facilitate phishing, deliver malicious content, or intercept user interactions, effectively compromising the trust relationship between the user and the application."
}