CVE-2025-41242 (GCVE-0-2025-41242)

Vulnerability from cvelistv5 – Published: 2025-08-18 08:47 – Updated: 2025-08-25 18:14
VLAI
Title
CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers
Summary
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
Vendor Product Version
VMware Spring Framework Affected: 6.2.x , < 6.2.10 (OSS)
Affected: 6.1.x , < 6.1.22 (commercial)
Affected: 5.3.x , < 5.3.44 (commercial)
Create a notification for this product.
Date Public
2025-08-14 20:41
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-41242",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-18T11:20:32.641979Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-25T18:14:59.837Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Spring Framework",
          "product": "Spring Framework",
          "vendor": "VMware",
          "versions": [
            {
              "lessThan": "6.2.10",
              "status": "affected",
              "version": "6.2.x",
              "versionType": "OSS"
            },
            {
              "lessThan": "6.1.22",
              "status": "affected",
              "version": "6.1.x",
              "versionType": "commercial"
            },
            {
              "lessThan": "5.3.44",
              "status": "affected",
              "version": "5.3.x",
              "versionType": "commercial"
            }
          ]
        }
      ],
      "datePublic": "2025-08-14T20:41:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpring Framework MVC applications can be vulnerable to a \u201cPath Traversal Vulnerability\u201d when deployed on a non-compliant Servlet container.\u003c/p\u003e\u003cp\u003eAn application can be vulnerable when all the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003ethe application is deployed as a WAR or with an embedded Servlet container\u003c/li\u003e\u003cli\u003ethe Servlet container \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization\"\u003edoes not reject suspicious sequences\u003c/a\u003e\u003c/li\u003e\u003cli\u003ethe application \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title\"\u003eserves static resources\u003c/a\u003e\u0026nbsp;with Spring resource handling\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "Spring Framework MVC applications can be vulnerable to a \u201cPath Traversal Vulnerability\u201d when deployed on a non-compliant Servlet container.\n\nAn application can be vulnerable when all the following are true:\n\n  *  the application is deployed as a WAR or with an embedded Servlet container\n  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization \n  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title \u00a0with Spring resource handling\n\n\nWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-18T08:47:07.427Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "http://spring.io/security/cve-2025-41242"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2025-41242",
    "datePublished": "2025-08-18T08:47:07.427Z",
    "dateReserved": "2025-04-16T09:30:17.799Z",
    "dateUpdated": "2025-08-25T18:14:59.837Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-41242",
      "date": "2026-07-29",
      "epss": "0.02054",
      "percentile": "0.79314"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-41242\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2025-08-18T09:15:28.637\",\"lastModified\":\"2026-06-17T09:22:39.677\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Spring Framework MVC applications can be vulnerable to a \u201cPath Traversal Vulnerability\u201d when deployed on a non-compliant Servlet container.\\n\\nAn application can be vulnerable when all the following are true:\\n\\n  *  the application is deployed as a WAR or with an embedded Servlet container\\n  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization \\n  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title \u00a0with Spring resource handling\\n\\n\\nWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.\"},{\"lang\":\"es\",\"value\":\"Las aplicaciones Spring Framework MVC pueden ser vulnerables a una \\\"Vulnerabilidad de Path Traversal\\\" cuando se implementan en un contenedor de Servlet no compatible. Una aplicaci\u00f3n puede ser vulnerable cuando se cumplen todas las siguientes condiciones: * la aplicaci\u00f3n se implementa como un WAR o con un contenedor de Servlet integrado * el contenedor de Servlet no rechaza secuencias sospechosas https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * la aplicaci\u00f3n sirve recursos est\u00e1ticos https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title con el manejo de recursos de Spring Hemos verificado que las aplicaciones implementadas en Apache Tomcat o Eclipse Jetty no son vulnerables, siempre que las funciones de seguridad predeterminadas no est\u00e9n deshabilitadas en la configuraci\u00f3n. Dado que no podemos comprobar los exploits en todos los contenedores de Servlet y variantes de configuraci\u00f3n, recomendamos encarecidamente actualizar su aplicaci\u00f3n.\"}],\"affected\":[{\"source\":\"security@vmware.com\",\"affectedData\":[{\"vendor\":\"VMware\",\"product\":\"Spring Framework\",\"defaultStatus\":\"unaffected\",\"packageName\":\"Spring Framework\",\"versions\":[{\"version\":\"6.2.x\",\"lessThan\":\"6.2.10\",\"versionType\":\"OSS\",\"status\":\"affected\"},{\"version\":\"6.1.x\",\"lessThan\":\"6.1.22\",\"versionType\":\"commercial\",\"status\":\"affected\"},{\"version\":\"5.3.x\",\"lessThan\":\"5.3.44\",\"versionType\":\"commercial\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-08-18T11:20:32.641979Z\",\"id\":\"CVE-2025-41242\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"http://spring.io/security/cve-2025-41242\",\"source\":\"security@vmware.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T03:06:15+00:00",
      "cve": "CVE-2025-41242",
      "id": "CVE-2025-41242",
      "initial_release_date": "2025-08-18T08:47:07.427000+00:00",
      "product_status:known_affected": "26",
      "product_status:known_not_affected": "4",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-41242.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-41242\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-18T11:20:32.641979Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-18T11:20:36.420Z\"}}], \"cna\": {\"title\": \"CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"VMware\", \"product\": \"Spring Framework\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2.x\", \"lessThan\": \"6.2.10\", \"versionType\": \"OSS\"}, {\"status\": \"affected\", \"version\": \"6.1.x\", \"lessThan\": \"6.1.22\", \"versionType\": \"commercial\"}, {\"status\": \"affected\", \"version\": \"5.3.x\", \"lessThan\": \"5.3.44\", \"versionType\": \"commercial\"}], \"packageName\": \"Spring Framework\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-08-14T20:41:00.000Z\", \"references\": [{\"url\": \"http://spring.io/security/cve-2025-41242\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Spring Framework MVC applications can be vulnerable to a \\u201cPath Traversal Vulnerability\\u201d when deployed on a non-compliant Servlet container.\\n\\nAn application can be vulnerable when all the following are true:\\n\\n  *  the application is deployed as a WAR or with an embedded Servlet container\\n  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization \\n  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title \\u00a0with Spring resource handling\\n\\n\\nWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eSpring Framework MVC applications can be vulnerable to a \\u201cPath Traversal Vulnerability\\u201d when deployed on a non-compliant Servlet container.\u003c/p\u003e\u003cp\u003eAn application can be vulnerable when all the following are true:\u003c/p\u003e\u003cul\u003e\u003cli\u003ethe application is deployed as a WAR or with an embedded Servlet container\u003c/li\u003e\u003cli\u003ethe Servlet container \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization\\\"\u003edoes not reject suspicious sequences\u003c/a\u003e\u003c/li\u003e\u003cli\u003ethe application \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title\\\"\u003eserves static resources\u003c/a\u003e\u0026nbsp;with Spring resource handling\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.\u003c/p\u003e\u003cbr\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"shortName\": \"vmware\", \"dateUpdated\": \"2025-08-18T08:47:07.427Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-41242\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-25T18:14:59.837Z\", \"dateReserved\": \"2025-04-16T09:30:17.799Z\", \"assignerOrgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"datePublished\": \"2025-08-18T08:47:07.427Z\", \"assignerShortName\": \"vmware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.