CVE-2026-22739— Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-22739
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
Source: NVD (National Vulnerability Database)
Vulnerability Description
Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Spring Cloud 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Spring Cloud是美国Spring团队的一款基于 Spring Boot 实现的微服务框架。 Spring Cloud 3.1.13之前版本、4.1.9之前版本、4.2.3之前版本、4.3.2之前版本和5.0.2之前版本存在安全漏洞，该漏洞源于配置文件参数处理不当，可能导致访问配置搜索目录之外的文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring Cloud | 3.1.x ~ 3.1.13 | - |
II. Public POCs for CVE-2026-22739
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Spring Cloud 3.1.x < 3.1.13, 4.1.x < 4.1.9, 4.2.x < 4.2.3, 4.3.x < 4.3.2, and 5.0.x < 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22739.yaml | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-22739
请登录查看更多情报信息。
IV. Related Vulnerabilities
V. Comments for CVE-2026-22739
No comments yet