CVE-2026-40985: Spring Web Flow EL Injection Vulnerability – MEDIUM CVSS 6.4

Technical summary

This vulnerability stems from improper handling of Unified EL expressions within Spring Web Flow's WebFlowELExpressionParser component (CWE-917: Expression Language Injection). When applications explicitly configure this parser, they become susceptible to EL injection attacks. An attacker with authenticated access can craft malicious EL expressions that are evaluated by the parser, leading to arbitrary code execution or information disclosure. The attack vector is network-accessible and requires low privilege (authenticated user) and user interaction (social engineering or UI-based payload delivery), resulting in a CVSS 3.1 score of 6.4 (MEDIUM severity).

Business impact

Organizations using affected Spring Web Flow versions face potential data exfiltration and unauthorized modification of application behavior. The requirement for authentication and user interaction limits the blast radius compared to unauthenticated exploits, but insider threats or compromised user accounts could weaponize this vulnerability to access confidential information or manipulate business logic. In regulated industries, unauthorized data access could trigger compliance violations. The moderate severity score reflects the combination of high impact (confidentiality and integrity) constrained by higher attack complexity and authentication requirements.

Affected systems

Spring Web Flow versions 4.0.0, 3.0.0 through 3.0.1, and 2.5.0 through 2.5.1 are affected. Organizations should inventory applications using these specific versions, particularly those explicitly configuring WebFlowELExpressionParser. Older versions (2.5.0–2.5.1) are significantly out of support; 3.0.x versions have limited support remaining. Version 4.0.0 represents the latest major release affected.

Exploitability

Active exploitation in the wild is not indicated (KEV status: not listed). The attack requires authenticated access, authenticated user interaction (likely via social engineering or malicious request crafting), and knowledge of the application's EL expression context. These factors elevate the attack complexity, making widespread opportunistic exploitation less likely than unauthenticated vulnerabilities. However, targeted exploitation by insider threats or against high-value applications remains viable. No public exploit code is known to be circulating, but researchers could develop working proofs of concept given the well-understood nature of EL injection attacks.

Remediation

Upgrade to patched versions released by the Spring Web Flow project. Verify against the official Spring Security Advisory for the exact patch versions available for your current major version. Organizations unable to patch immediately should review and restrict authentication scopes, disable WebFlowELExpressionParser use if not required, or apply input validation and expression sandboxing if available. Monitor for suspicious authenticated user behavior and EL expression errors in application logs.

Patch guidance

Consult the Spring Web Flow project's official security advisories for patched versions corresponding to your deployment. Patches are expected for the 4.0.x, 3.0.x, and 2.5.x release lines, though 2.5.x is end-of-life and may not receive updates—consider upgrading to a supported version. Before patching, test in a staging environment to ensure compatibility with custom EL expressions or extensions. Plan phased deployment for applications with high availability requirements.

Detection guidance

Monitor application logs for unusual EL expression evaluation errors, particularly in WebFlowELExpressionParser logs. Search for suspicious authenticated user sessions followed by expression evaluation failures or unexpected data access patterns. Network-level detection is challenging, but anomalous authenticated session activity combined with expression parser errors should trigger investigation. Application performance monitoring can detect unexpected computational spikes from malicious EL expressions. Implement alerting on failed and successful authentication combined with subsequent parser errors.

Why prioritize this

Although rated MEDIUM severity, prioritization should reflect your organization's reliance on Spring Web Flow and the sensitivity of data exposed through vulnerable applications. Version 4.0.0 should be prioritized as it is currently supported; 2.5.x versions should be migrated away from entirely. Applications accessible to large numbers of authenticated users or handling high-value data warrant faster remediation. The requirement for authenticated access and user interaction places this below critical-severity vulnerabilities but above low-impact issues in most risk matrices.

Risk score, explained

CVSS 3.1 score 6.4 (MEDIUM) reflects: high impact on confidentiality and integrity (disclosure and modification possible), network attack vector, but constrained by high attack complexity (EL expression crafting), low privilege requirement (authenticated user only), and required user interaction. The score appropriately captures that an attacker needs authentication, some technical skill, and victim cooperation—significantly raising the bar compared to unauthenticated or low-complexity vulnerabilities.

Frequently asked questions