Get ahead
VMware offers training and certification to turbo-charge your progress.
Learn moreCVE-2026-40987: Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization
Description
A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.
Affected Spring Products and Versions
Spring Integration:
- 7.0.0 - 7.0.4
- 6.5.0 - 6.5.8
- 6.4.0 - 6.4.11
- 6.3.0 - 6.3.14
- 5.5.0 - 5.5.20
- Older, unsupported versions are also affected
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 5.5.x | 5.5.21 | Enterprise Support Only |
| 6.3.x | 6.3.15 | Enterprise Support Only |
| 6.4.x | 6.4.12 | Enterprise Support Only |
| 6.5.x | 6.5.8.1 | Enterprise Support Only |
| 6.5.9 | OSS | |
| 7.0.x | 7.0.4.1 | Enterprise Support Only |
| 7.0.5 | OSS |
No further mitigation steps are necessary.
Credit
The issue was reported responsibly by:
- M0untainShley
- SharlongWen
- daehyuh
References
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L&version=3.1
History
- 2026-06-10: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy
Get support
Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.
Learn moreUpcoming events
Check out all the upcoming events in the Spring community.
View all