Description

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-27T17:18:57.780Z",
  "pubdate": "2026-08-27T17:18:57.780Z",
  "executiveSummary": "A path traversal vulnerability exists in the Spring Framework's FreeMarker integration, specifically when applications dynamically resolve view names based on untrusted user input.\nThe vulnerability occurs because the SpringTemplateLoader does not sufficiently validate or sanitize view name strings before passing them to the underlying template loading mechanism.\nAn unauthenticated, remote attacker can exploit this flaw by providing crafted inputs containing traversal sequences (e.g., ../) to bypass intended directory restrictions.\nSuccessful exploitation allows attackers to access and potentially render arbitrary files residing on the filesystem that the application process has access to, leading to information disclosure.\nAffected products include Spring Framework versions 7.0.0-7.0.8, 6.2.0-6.2.19, 6.1.0-6.1.28, 6.0.0-6.0.30, 5.3.0-5.3.49, and 5.2.25.RELEASE and earlier.\nThis vulnerability poses a significant risk to confidentiality, as sensitive configuration files, source code, or system files may be exposed depending on the application's operating environment and file system permissions.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of user-supplied view names within the Spring Framework when configured to use the SpringTemplateLoader for FreeMarker template resolution. When an application controller uses untrusted input to define the view name (e.g., return \"views/\" + userInput), the framework fails to enforce strict path validation.\nThe SpringTemplateLoader is designed to resolve templates from the Spring application context; however, it lacks internal mechanisms to reject path traversal sequences when resolving the template resource. Consequently, if the input is not sanitized by the application developer, the template resolver interprets directory traversal characters (such as ../) relative to the configured template directory base path.\nAn attacker initiates the attack by sending a crafted HTTP request containing malicious traversal sequences within the parameter bound to the view resolver. For example, if the application expects a view name to select a template, an attacker may inject sequences like '..%2f..%2f..%2fetc%2fpasswd' into the view name parameter.\nUpon receiving the request, the Spring MVC controller processes the user input and constructs the path string. This string is then passed to the FreeMarker view resolver. Because the resolver does not perform canonicalization or path validation, it treats the traversal sequence as a legitimate directive to navigate outside the intended template root directory.\nThe FreeMarker integration then attempts to load the file specified by the attacker-controlled path. If the web application's service account possesses sufficient filesystem permissions to access the target file, the engine reads the file contents and includes them in the rendered output returned to the attacker's browser.\nThis attack does not require authentication or elevated privileges, as it targets the template resolution logic accessible via standard web request processing. The scope of impact is limited by the filesystem permissions assigned to the underlying application server process. In highly restricted environments, impact may be minimized, but in scenarios where the application runs with excessive permissions, the risk of unauthorized file disclosure is high. The vulnerability affects a wide range of Spring Framework versions, specifically 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and versions 5.2.25.RELEASE and earlier."
}