CVE-2026-22737— Spring Framework Improper Path Limitation with Script View Templates
Quick assessment
Affected
Spring Spring Framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Spring Framework是Spring开源的一款应用开发框架。 Spring Framework 7.0.5及之前版本、6.2.16及之前版本、6.1.25及之前版本和5.3.46及之前版本存在安全漏洞，该漏洞源于使用Java脚本引擎模板视图可能导致脚本模板视图配置位置之外的文件内容泄露。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-22737
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Spring Framework Improper Path Limitation with Script View Templates
Source: CVE Program / CVE List V5
Vulnerability Description
Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Spring Framework 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Spring Framework是Spring开源的一款应用开发框架。 Spring Framework 7.0.5及之前版本、6.2.16及之前版本、6.1.25及之前版本和5.3.46及之前版本存在安全漏洞，该漏洞源于使用Java脚本引擎模板视图可能导致脚本模板视图配置位置之外的文件内容泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring Framework | 7.0.0 ~ 7.0.5 | - |
|
II. Public POCs for CVE-2026-22737
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-22737
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-22737 (1)
Same Patch Batch · Spring · 2026-03-19 · 4 CVEs total
| CVE-2026-22731 | 8.2 HIGH | Authentication Bypass under Actuator Health groups paths |
| CVE-2026-22733 | 8.2 HIGH | Authentication Bypass under Actuator CloudFoundry endpoints |
| CVE-2026-22735 | 2.6 LOW | Server Sent Event stream corruption |
IV. Related Vulnerabilities
Same product: Spring Framework
-
CVE-2026-59314
Spring Framework response splitting in ContentDisposition -
CVE-2026-59313
Server Sent Event stream corruption in Spring MVC functional -
CVE-2026-59283
Spring Framework Safety Guard Bypass via SpEL Expression Com -
CVE-2026-59282
Spring Framework Denial of Service via Unbounded List Growth -
CVE-2026-59281
Spring Framework Cross-site Scripting via EscapedErrors
Same vendor: Spring
-
CVE-2026-59324
fluxTransform shared RequestMessageHolder causes cross-messa -
CVE-2026-59322
EmbeddedHeadersJsonMessageMapper default gives wire peer ful -
CVE-2026-59321
Shared JSR-223 ScriptEngine evaluated concurrently without T -
CVE-2026-59320
In Spring AMQP the link credit never replenished on listener -
CVE-2026-59319
RediSearch Tag Injection in RedisChatMemoryRepository Allows
V. Comments for CVE-2026-22737
No comments yet