CVE-2026-40987: Spring Integration Path Traversal – File Write Vulnerability

Technical summary

CVE-2026-40987 is a path traversal vulnerability (CWE-22) in Spring Integration's remote file handling components. When a client application uses Spring Integration to fetch files from FTP, SFTP, or SMB servers, the framework fails to properly validate or restrict the destination paths during write operations. A malicious server response can include path traversal sequences (such as '../' or absolute paths) that allow the attacker to write files outside the application's configured local-directory. The vulnerability affects Spring Integration versions 5.5.0 through 5.5.20, 6.3.0 through 6.3.14, 6.4.0 through 6.4.11, 6.5.0 through 6.5.8, and 7.0.0 through 7.0.4. Exploitation requires authenticated network access to the remote file server and user interaction (such as triggering a file download or sync operation), though the impact once successful is severe.

Business impact

Organizations using Spring Integration for automated file transfer workflows face significant operational and security risk. Attackers exploiting this vulnerability could inject malicious code into deployed applications, modify configuration files to alter system behavior, overwrite application binaries, or plant backdoors for persistent access. In supply-chain scenarios, if a trusted file server is compromised, thousands of downstream systems may be silently affected without detection. The vulnerability is particularly dangerous in CI/CD pipelines, document processing systems, and enterprise integration platforms where file downloads are automated and trusted. Recovery requires forensic investigation, rollback, and re-provisioning, resulting in substantial downtime and remediation costs.

Affected systems

Spring Integration is a widely-used framework in the Spring ecosystem for enterprise application integration. Any application using Spring Integration 5.5.0–5.5.20, 6.3.0–6.3.14, 6.4.0–6.4.11, 6.5.0–6.5.8, or 7.0.0–7.0.4 that interfaces with remote FTP, SFTP, or SMB servers is affected. This includes custom integrations, middleware, data pipelines, and message-driven systems. Organizations should audit their dependency trees for Spring Integration presence and version. Applications running older Long-Term Support (LTS) branches remain vulnerable if not patched; those on unsupported versions have no vendor fix and require either upgrade or compensating controls.

Exploitability

The attack vector is network-based but requires two preconditions: (1) the client application must be configured to connect to a remote file server, and (2) an attacker must either compromise that legitimate server or convince the application to connect to an attacker-controlled server. Real-world exploitability is moderate. Passive network monitoring alone does not enable exploitation; active server compromise or man-in-the-middle capability is necessary. However, once those conditions are met, exploitation is straightforward—the attacker simply crafts a malicious server response with path traversal payloads. The requirement for user interaction (triggering a sync or fetch operation) slightly reduces but does not eliminate risk in automated workflows. The vulnerability is not known to be actively exploited in the wild as of publication, but the technical barrier to exploitation is low.

Remediation

Immediately update Spring Integration to patched versions. Verify the exact version in your application and consult the official Spring Integration release notes for the recommended upgrade path. For organizations unable to upgrade immediately, implement network-level controls: restrict outbound connections to known, trusted file servers; use allowlisting for server addresses and ports; monitor for unexpected file writes outside configured directories; consider disabling remote file transfer features until patches are applied. Code review of custom file-handling logic may reveal similar path-traversal risks. Ensure that file-permission models on the application server prevent unauthorized writes to sensitive system directories, even if the application vulnerability is exploited.

Patch guidance

Spring Integration has released patched versions for all affected branches. Consult the official VMware/Spring advisory for exact version numbers and release dates. For version 7.x users, upgrade to 7.0.5 or later (verify against vendor advisory). For 6.5.x users, upgrade to 6.5.9 or later. For 6.4.x and 6.3.x users, follow the vendor's recommended upgrade version. For 5.5.x (no longer under active support), consider upgrading to a current LTS version; if that is not feasible, apply the patch version designated for 5.5.x branch or implement compensating controls. Test patches in a staging environment that mirrors production file-server configurations before deploying to production. Ensure all instances of the affected framework are patched, including development, testing, and production systems.

Detection guidance

Monitor application logs and file-system access logs for writes to unexpected directories, especially outside the configured local-directory for file transfers. Implement integrity monitoring on critical configuration files, application binaries, and system directories. Watch for error messages or anomalies in Spring Integration's remote file handler logs (e.g., connection timeouts, unusual file paths in logs). Network segmentation and monitoring of traffic to remote file servers can detect lateral movement if exploitation has already occurred. Consider SIEM rules that trigger on file-write operations initiated by Java/Spring processes to sensitive paths. In incident response, acquire file-system snapshots and timestamp analysis of files created or modified after the vulnerability window to identify compromised artifacts.

Why prioritize this

This vulnerability merits immediate priority due to its HIGH CVSS score (7.1), the broad range of affected versions spanning multiple major releases, and the severe impact of arbitrary file write. While exploitation requires network access and server compromise, the consequences—code execution and post-exploitation freedom—are severe. Organizations with automated file-transfer workflows should patch within days, not weeks. Those with manual, infrequent file transfers have slightly more breathing room but should still prioritize patching to eliminate supply-chain risk. The lack of active public exploitation does not reduce urgency; the simplicity of the attack once preconditions are met means exploitation is inevitable if left unpatched.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: network attack vector (no local access required); high attack complexity (requires server compromise and user interaction); low privileges required (attacker does not need system-level access, only server access); limited scope (impacts the client system but does not inherently affect other network segments); low confidentiality impact (file-write itself does not leak data, though files can be exfiltrated later); high integrity impact (arbitrary file write is a direct integrity violation); low availability impact (the attack does not directly cause denial of service, though malicious files could trigger application crashes). The score appropriately captures the severity while acknowledging the prerequisite of server compromise.

Frequently asked questions