File and Path Handling

Every one of the 20 is a mark on the map. Named now: 1 to 20, most at risk first.

1. Spring Cloud Config Server - Local File InclusionCVE-2019-3799Spring · 85% likely

   CWE-22

2. WebMvc.fn/WebFlux.fn - Path TraversalCVE-2024-38816Spring · CVSS 7.5 · 21% likely

   CWE-22

3. Spring Cloud Config Server - Path TraversalCVE-2026-22739Spring · CVSS 8.6 · 1.2% likely

   CWE-22

4. Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request u…CVE-2026-40982Spring · CVSS 9.1 · 0.7% likely

   CWE-22

5. Spring Framework Improper Path Limitation in XsltViewCVE-2026-47884Spring · CVSS 9.8 · 0.6% likely

   CWE-22

6. Spring Cloud Config Server Native Environment Repository ExposureCVE-2026-47894Spring · CVSS 4.9 · 0.5% likely

   CWE-22

7. Spring Framework Improper Path Limitation with Script View TemplatesCVE-2026-22737Spring · CVSS 5.9 · 0.4% likely

   CWE-22

8. LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills APICVE-2026-41863Spring · CVSS 6.5 · 0.4% likely

   CWE-22

9. Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creationCVE-2026-59311Spring · CVSS 6.8 · 0.4% likely

   CWE-59

10. Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFluxCVE-2026-41843Spring · CVSS 5.9 · 0.4% likely

    CWE-22

11. Arbitrary File Write via Path Traversal in ResourceCacheServiceCVE-2026-59294Spring · CVSS 5.9 · 0.4% likely

    CWE-22

12. Spring Framework Path Traversal via Backslash in SpringTemplateLoaderCVE-2026-59280Spring · CVSS 4.3 · 0.3% likely

    CWE-22

13. Predictable cache directory location allows local ONNX model substitution in Spring AICVE-2026-47852Spring · CVSS 7.5 · 0.3% likely

    CWE-377

14. ZipTransformer uses file_name header to build workDirectory path without sanitizationCVE-2026-47862Spring · CVSS 5.4 · 0.3% likely

    CWE-22

15. In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information discl…CVE-2024-22236Spring · CVSS 3.3 · 0.2% likely

    CWE-377

16. Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalizationCVE-2026-40987Spring · CVSS 7.1 · 0.2% likely

    CWE-22

17. A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.servlet.session.persistent` is set to `tr…CVE-2026-40973Spring · CVSS 7 · 0.1% likely

    CWE-377

18. When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the a…CVE-2026-40977Spring · CVSS 4.7 · 0.1% likely

    CWE-59

19. In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4…CVE-2026-40979Spring · CVSS 6.1 · 0.1% likely

    CWE-377

20. Predictable Temp Directory in Artemis Auto-configurationCVE-2026-41001Spring · CVSS 5.3 · 0.1% likely

    CWE-377

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.