{"id":"CVE-2026-47884","aliases":["GHSA-pc63-qcmh-9cmg"],"url":"https://o3.security/vulnerability/CVE-2026-47884","summary":"Spring Framework Improper Path Limitation in XsltView","details":"Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an \"/**\" mapping that results in view rendering, and where the view name is not explicitly specified.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19\nSpring Framework 6.1.0 - 6.1.28\nSpring Framework 6.0.0 - 6.0.30\nSpring Framework 5.3.0 - 5.3.49\nSpring Framework 5.2.25.RELEASE and earlier","published":"2026-08-27T05:21:32.920Z","modified":"2026-10-24T10:30:56.784090420Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.springframework:spring-webmvc","fixedVersion":null},{"ecosystem":"Maven","name":"org.springframework:spring-webmvc","fixedVersion":null},{"ecosystem":"Maven","name":"org.springframework:spring-webmvc","fixedVersion":null},{"ecosystem":"Maven","name":"org.springframework:spring-webmvc","fixedVersion":null},{"ecosystem":"Maven","name":"org.springframework:spring-webmvc","fixedVersion":null},{"ecosystem":"Maven","name":"org.springframework:spring-webmvc","fixedVersion":"7.0.9"}],"fix":{"url":"https://github.com/spring-projects/spring-framework/commit/692dbc9160de3b5de50ccedeee014716d0cedb7b","label":"spring-projects/spring-framework@692dbc9"},"references":[{"type":"WEB","url":"https://spring.io/security/cve-2026-47884"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47884.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47884"},{"type":"WEB","url":"https://github.com/spring-projects/spring-framework/commit/692dbc9160de3b5de50ccedeee014716d0cedb7b"},{"type":"PACKAGE","url":"https://github.com/spring-projects/spring-framework"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:56.784090420Z"}}