Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to…
Applications built on the Spring Framework's functional web frameworks, WebMvc.fn or WebFlux.fn, that serve static resources contain a path traversal flaw in how those resources are handled. An unauthenticated remote attacker who can reach the application over the network can send crafted HTTP requests, with no user interaction or special configuration required, to read any file the Spring application's process can access on the file system.
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) was available 5 days before disclosure.
- Public exploit codePoC-in-GitHub5 days before
- Disclosedday 0
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
See the family tree12 related vulnerabilities in the same code over 3 months. The latest fix listed for spring-webmvc is 7.0.6.
Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.
- same family
relatedMedium
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Same code patched: ResourceWebHandler.java, ResourceHttpRequestHandler.java (machine-matched)commit 3bfbe30commit fb7890dcommit 23656ae
This CVECVE-2024-38819Applications serving static resources through the functional web…19 Dec 2024
9 more CVEs are in this family. See the family tree
Fixes in spring-webmvcMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
- 6.0.7CVE-2023-2086027 Mar 2023
- 6.0.14CVE-2023-3405328 Nov 2023
- 6.1.13CVE-2024-3881613 Sep 2024
- 6.1.14CVE-2024-3881919 Dec 2024
- 6.2.10CVE-2025-4124218 Aug 2025
- 7.0.6CVE-2026-2273519 Mar 2026
- 7.0.6CVE-2026-2273719 Mar 2026Latest listed
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV2 packages in 1 ecosystem. No single main package: each of these ships the affected code.
- Mavenorg.springframework:spring-webfluxAffected: 6.1.0 up to 6.1.14; 6.0.0 through 6.0.24; 5.3.40 and earlierUpgrade to 6.1.14 or later
- Mavenorg.springframework:spring-webmvcAffected: 6.1.0 up to 6.1.14; 6.0.0 through 6.0.24; 5.3.40 and earlierUpgrade to 6.1.14 or later
What security researchers reported
Not named in any threat report yetAlso mentioned in 5 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actualización Oracle update - 20/07/202520 Jul 2025
- ACTUALIZACION | ||Oracle Critical Patch Update Advisory - April 202522 Apr 2025
- ACTUALIZACION | SAP Security Patch Day - March 202531 Mar 2025
- ACTUALIZACION | SAP Security Patch Day - March 202531 Mar 2025
- Medusa Ransomware: A Growing Threat with a Bold Online Presence4 Dec 2024