Spring Framework MVC Applications Path Traversal Vulnerability

中 5.9CVE-2025-41242 · GHSA-r936-gwx5-v52f · 18/08/2025 公開 · 17/06/2026 更新

要点

CVE-2025-41242 は org.springframework:spring-webmvc に影響する深刻度「中」 (CVSS 5.9) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.1%（全脆弱性の 81.9% より高い）。
対処：6.2.10 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.springframework:spring-webmvc Maven	`≥ 5.3.0, ≤ 5.3.43≥ 6.0.0, ≤ 6.0.29≥ 6.1.0, ≤ 6.1.21≥ 6.2.0, < 6.2.10`	`6.2.10`

概要

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

the application is deployed as a WAR or with an embedded Servlet container
the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization
the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling

We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

NVD の説明

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.