CVE-2026-40987— Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization
Possible ATT&CK Techniques 1AI
T1571 · Non-Standard PortGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-40987
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization
Source: NVD (National Vulnerability Database)
Vulnerability Description
A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring Integration | 7.0.0 ~ 7.0.5 | - |
II. Public POCs for CVE-2026-40987
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40987
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-40987 (1)
Same Patch Batch · Spring · 2026-06-11 · 15 CVEs total
| CVE-2026-40999 | 8.6 HIGH | Spring WS SSRF via unvalidated WS-Addressing reply destinations |
| CVE-2026-40998 | 8.2 HIGH | Jaxp13 XPath XXE via StreamSource and SAXSource |
| CVE-2026-40994 | 8.2 HIGH | Wss4jSecurityInterceptor disables WS-I BSP validation by default |
| CVE-2026-41699 | 8.1 HIGH | Unsafe Deserialization in Spring GraphQL |
| CVE-2026-41700 | 8.1 HIGH | Cross-Site WebSocket Hijacking in Spring for GraphQL |
| CVE-2026-41856 | 7.5 HIGH | Spring GraphQL Annotation Detection Vulnerability |
| CVE-2026-40985 | 6.4 MEDIUM | Data Binding Vulnerability in Spring Web Flow with Unified EL Parser |
| CVE-2026-40995 | 5.4 MEDIUM | X.509 authentication bypasses Spring Security account checks |
| CVE-2026-41001 | 5.3 MEDIUM | Predictable Temp Directory in Artemis Auto-configuration |
| CVE-2026-40997 | 5.3 MEDIUM | SOAP security faults leak Spring Security account state |
| CVE-2026-40992 | 5.0 MEDIUM | Mail Auto-Configuration Does Not Enable SSL Hostname Verification |
| CVE-2026-40996 | 4.8 MEDIUM | Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default |
| CVE-2026-40986 | 4.8 MEDIUM | Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML |
| CVE-2026-41000 | 3.7 LOW | WSS4J validation does not use configured replay cache |
IV. Related Vulnerabilities
Same vendor: Spring
- CVE-2026-41856
Spring GraphQL Annotation Detection Vulnerability - CVE-2026-41700
Cross-Site WebSocket Hijacking in Spring for GraphQL - CVE-2026-41699
Unsafe Deserialization in Spring GraphQL - CVE-2026-41001
Predictable Temp Directory in Artemis Auto-configuration - CVE-2026-41000
WSS4J validation does not use configured replay cache
Same weakness: CWE-22
- CVE-2026-12089
WS Optimize – All-in-One Speed Booster & Cache Tools <= 3.3. - CVE-2026-11442
Allegra exportReport Directory Traversal Information Disclos - CVE-2026-53825
OpenClaw < 2026.4.7 - Arbitrary Local File Read via memory-w - CVE-2026-53519
Nezha Monitoring: Pre-auth path traversal via /dashboard.. p - CVE-2026-54394
MISP organisation logo path traversal allows retrieval of ar
V. Comments for CVE-2026-40987
No comments yet