{"id":"CVE-2026-40982","published":"2026-05-07T03:49:30Z","modified":"2026-07-15T01:00:13Z","title":"Spring Cloud Config allows applications to serve arbitrary text and binary files through the…","vendor":"Spring","product":"Spring Cloud Config","tier":"tail","description":{"text":"Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.\nSpring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00727,"percentile":0.54001,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://spring.io/security/cve-2026-40982","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40982","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467619","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40982.json","tags":["x_sadp-csaf-vex"]}],"priority":{"score":22.2,"factors":[{"name":"EPSS percentile","points":10.8},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.37}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-08-05","earliestUrl":"https://github.com/xiaoqiMikko/scc-check","repos":[{"name":"xiaoqiMikko/scc-check","url":"https://github.com/xiaoqiMikko/scc-check","stars":0,"created":"2026-08-05"}]},"first":{"date":"2026-08-05","source":"PoC-in-GitHub","url":"https://github.com/xiaoqiMikko/scc-check"},"provenance":"source"},"vendorSlug":"spring","affectedVersions":[{"vendor":"Spring","product":"Spring Cloud Config","versions":[">= 3.1.0, < 3.1.14",">= 4.1.0, < 4.1.10",">= 4.2.0, < 4.2.7",">= 4.3.0, < 4.3.3",">= 5.0.0, < 5.0.3"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","vulnerableRanges":["<=3.1.13",">=4.1.0, <=4.1.9",">=4.2.0, <=4.2.6",">=4.3.0, <4.3.3",">=5.0.0, <5.0.3"],"patched":["4.3.3","5.0.3"],"from":["GHSA-6g23-24mc-hx6x"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-28246","exploited":false,"provenance":"source"}}