Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-22739— Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks

Quick assessment

Affected
Spring Spring Cloud
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Spring Cloud是美国Spring团队的一款基于 Spring Boot 实现的微服务框架。 Spring Cloud 3.1.13之前版本、4.1.9之前版本、4.2.3之前版本、4.3.2之前版本和5.0.2之前版本存在安全漏洞，该漏洞源于配置文件参数处理不当，可能导致访问配置搜索目录之外的文件。

CVSS 8.6 · High EPSS 1.22% · P68

Public Exploits 1

Nuclei · 1 CVE-2026-22739.yaml [template]

Possible ATT&CK Techniques 1 AI

T1552.005 · Cloud Instance Metadata API
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-22739

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
Source: CVE Program / CVE List V5
Vulnerability Description
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Spring Cloud 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Spring Cloud是美国Spring团队的一款基于 Spring Boot 实现的微服务框架。 Spring Cloud 3.1.13之前版本、4.1.9之前版本、4.2.3之前版本、4.3.2之前版本和5.0.2之前版本存在安全漏洞，该漏洞源于配置文件参数处理不当，可能导致访问配置搜索目录之外的文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Spring Spring Cloud 3.1.x ~ 3.1.13 -

II. Public POCs for CVE-2026-22739

# POC Description Source Link Shenlong Link
1 Spring Cloud 3.1.x < 3.1.13, 4.1.x < 4.1.9, 4.2.x < 4.2.3, 4.3.x < 4.3.2, and 5.0.x < 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22739.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-22739

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-22739 (1)

IV. Related Vulnerabilities

Same vendor: Spring

V. Comments for CVE-2026-22739

No comments yet

Leave a comment