CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-22739

Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.012

EPSS Ranking 67.3%

CVSS Severity

CVSS v3 Score 8.6

References

https://spring.io/security/cve-2026-22739

Products affected by CVE-2026-22739

Vmware » Spring Cloud Config » Version: 1.0.0

cpe:2.3:a:vmware:spring_cloud_config:1.0.0
Vmware » Spring Cloud Config » Version: 1.0.1

cpe:2.3:a:vmware:spring_cloud_config:1.0.1
Vmware » Spring Cloud Config » Version: 1.0.3

cpe:2.3:a:vmware:spring_cloud_config:1.0.3
Vmware » Spring Cloud Config » Version: 1.0.4

cpe:2.3:a:vmware:spring_cloud_config:1.0.4
Vmware » Spring Cloud Config » Version: 1.1.0

cpe:2.3:a:vmware:spring_cloud_config:1.1.0
Vmware » Spring Cloud Config » Version: 1.1.1

cpe:2.3:a:vmware:spring_cloud_config:1.1.1
Vmware » Spring Cloud Config » Version: 1.1.2

cpe:2.3:a:vmware:spring_cloud_config:1.1.2
Vmware » Spring Cloud Config » Version: 1.1.3

cpe:2.3:a:vmware:spring_cloud_config:1.1.3
Vmware » Spring Cloud Config » Version: 1.2.0

cpe:2.3:a:vmware:spring_cloud_config:1.2.0
Vmware » Spring Cloud Config » Version: 1.2.1

cpe:2.3:a:vmware:spring_cloud_config:1.2.1
Vmware » Spring Cloud Config » Version: 1.2.2

cpe:2.3:a:vmware:spring_cloud_config:1.2.2
Vmware » Spring Cloud Config » Version: 1.2.3

cpe:2.3:a:vmware:spring_cloud_config:1.2.3
Vmware » Spring Cloud Config » Version: 1.3.0

cpe:2.3:a:vmware:spring_cloud_config:1.3.0
Vmware » Spring Cloud Config » Version: 1.3.1

cpe:2.3:a:vmware:spring_cloud_config:1.3.1
Vmware » Spring Cloud Config » Version: 1.3.2

cpe:2.3:a:vmware:spring_cloud_config:1.3.2
Vmware » Spring Cloud Config » Version: 1.3.4

cpe:2.3:a:vmware:spring_cloud_config:1.3.4
Vmware » Spring Cloud Config » Version: 1.4.0

cpe:2.3:a:vmware:spring_cloud_config:1.4.0
Vmware » Spring Cloud Config » Version: 1.4.1

cpe:2.3:a:vmware:spring_cloud_config:1.4.1
Vmware » Spring Cloud Config » Version: 1.4.2

cpe:2.3:a:vmware:spring_cloud_config:1.4.2
Vmware » Spring Cloud Config » Version: 1.4.3

cpe:2.3:a:vmware:spring_cloud_config:1.4.3
Vmware » Spring Cloud Config » Version: 1.4.4

cpe:2.3:a:vmware:spring_cloud_config:1.4.4
Vmware » Spring Cloud Config » Version: 1.4.5

cpe:2.3:a:vmware:spring_cloud_config:1.4.5
Vmware » Spring Cloud Config » Version: 1.4.6

cpe:2.3:a:vmware:spring_cloud_config:1.4.6
Vmware » Spring Cloud Config » Version: 1.4.7

cpe:2.3:a:vmware:spring_cloud_config:1.4.7
Vmware » Spring Cloud Config » Version: 2.0.0

cpe:2.3:a:vmware:spring_cloud_config:2.0.0
Vmware » Spring Cloud Config » Version: 2.0.1

cpe:2.3:a:vmware:spring_cloud_config:2.0.1
Vmware » Spring Cloud Config » Version: 2.0.2

cpe:2.3:a:vmware:spring_cloud_config:2.0.2
Vmware » Spring Cloud Config » Version: 2.0.3

cpe:2.3:a:vmware:spring_cloud_config:2.0.3
Vmware » Spring Cloud Config » Version: 2.0.4

cpe:2.3:a:vmware:spring_cloud_config:2.0.4
Vmware » Spring Cloud Config » Version: 2.0.5

cpe:2.3:a:vmware:spring_cloud_config:2.0.5
Vmware » Spring Cloud Config » Version: 2.1.0

cpe:2.3:a:vmware:spring_cloud_config:2.1.0
Vmware » Spring Cloud Config » Version: 2.1.1

cpe:2.3:a:vmware:spring_cloud_config:2.1.1
Vmware » Spring Cloud Config » Version: 2.1.2

cpe:2.3:a:vmware:spring_cloud_config:2.1.2
Vmware » Spring Cloud Config » Version: 2.1.3

cpe:2.3:a:vmware:spring_cloud_config:2.1.3
Vmware » Spring Cloud Config » Version: 2.1.4

cpe:2.3:a:vmware:spring_cloud_config:2.1.4
Vmware » Spring Cloud Config » Version: 2.1.5

cpe:2.3:a:vmware:spring_cloud_config:2.1.5
Vmware » Spring Cloud Config » Version: 2.1.6

cpe:2.3:a:vmware:spring_cloud_config:2.1.6
Vmware » Spring Cloud Config » Version: 2.1.7

cpe:2.3:a:vmware:spring_cloud_config:2.1.7
Vmware » Spring Cloud Config » Version: 2.1.8

cpe:2.3:a:vmware:spring_cloud_config:2.1.8
Vmware » Spring Cloud Config » Version: 2.1.9

cpe:2.3:a:vmware:spring_cloud_config:2.1.9
Vmware » Spring Cloud Config » Version: 2.2.0

cpe:2.3:a:vmware:spring_cloud_config:2.2.0
Vmware » Spring Cloud Config » Version: 2.2.1

cpe:2.3:a:vmware:spring_cloud_config:2.2.1
Vmware » Spring Cloud Config » Version: 2.2.2

cpe:2.3:a:vmware:spring_cloud_config:2.2.2
Vmware » Spring Cloud Config » Version: 2.2.3

cpe:2.3:a:vmware:spring_cloud_config:2.2.3
Vmware » Spring Cloud Config » Version: 2.2.4

cpe:2.3:a:vmware:spring_cloud_config:2.2.4
Vmware » Spring Cloud Config » Version: 2.2.5

cpe:2.3:a:vmware:spring_cloud_config:2.2.5
Vmware » Spring Cloud Config » Version: 2.2.6

cpe:2.3:a:vmware:spring_cloud_config:2.2.6
Vmware » Spring Cloud Config » Version: 2.2.7

cpe:2.3:a:vmware:spring_cloud_config:2.2.7
Vmware » Spring Cloud Config » Version: 2.2.8

cpe:2.3:a:vmware:spring_cloud_config:2.2.8
Vmware » Spring Cloud Config » Version: 3.0.0

cpe:2.3:a:vmware:spring_cloud_config:3.0.0
Vmware » Spring Cloud Config » Version: 3.0.1

cpe:2.3:a:vmware:spring_cloud_config:3.0.1
Vmware » Spring Cloud Config » Version: 3.0.2

cpe:2.3:a:vmware:spring_cloud_config:3.0.2
Vmware » Spring Cloud Config » Version: 3.0.3

cpe:2.3:a:vmware:spring_cloud_config:3.0.3
Vmware » Spring Cloud Config » Version: 3.0.4

cpe:2.3:a:vmware:spring_cloud_config:3.0.4
Vmware » Spring Cloud Config » Version: 3.0.5

cpe:2.3:a:vmware:spring_cloud_config:3.0.5
Vmware » Spring Cloud Config » Version: 3.0.6

cpe:2.3:a:vmware:spring_cloud_config:3.0.6
Vmware » Spring Cloud Config » Version: 3.0.7

cpe:2.3:a:vmware:spring_cloud_config:3.0.7
Vmware » Spring Cloud Config » Version: 3.1.0

cpe:2.3:a:vmware:spring_cloud_config:3.1.0
Vmware » Spring Cloud Config » Version: 3.1.1

cpe:2.3:a:vmware:spring_cloud_config:3.1.1
Vmware » Spring Cloud Config » Version: 3.1.10

cpe:2.3:a:vmware:spring_cloud_config:3.1.10
Vmware » Spring Cloud Config » Version: 3.1.2

cpe:2.3:a:vmware:spring_cloud_config:3.1.2
Vmware » Spring Cloud Config » Version: 3.1.3

cpe:2.3:a:vmware:spring_cloud_config:3.1.3
Vmware » Spring Cloud Config » Version: 3.1.4

cpe:2.3:a:vmware:spring_cloud_config:3.1.4
Vmware » Spring Cloud Config » Version: 3.1.5

cpe:2.3:a:vmware:spring_cloud_config:3.1.5
Vmware » Spring Cloud Config » Version: 3.1.6

cpe:2.3:a:vmware:spring_cloud_config:3.1.6
Vmware » Spring Cloud Config » Version: 3.1.7

cpe:2.3:a:vmware:spring_cloud_config:3.1.7
Vmware » Spring Cloud Config » Version: 3.1.8

cpe:2.3:a:vmware:spring_cloud_config:3.1.8
Vmware » Spring Cloud Config » Version: 3.1.9

cpe:2.3:a:vmware:spring_cloud_config:3.1.9
Vmware » Spring Cloud Config » Version: 4.1.0

cpe:2.3:a:vmware:spring_cloud_config:4.1.0
Vmware » Spring Cloud Config » Version: 4.1.1

cpe:2.3:a:vmware:spring_cloud_config:4.1.1
Vmware » Spring Cloud Config » Version: 4.1.2

cpe:2.3:a:vmware:spring_cloud_config:4.1.2
Vmware » Spring Cloud Config » Version: 4.1.3

cpe:2.3:a:vmware:spring_cloud_config:4.1.3
Vmware » Spring Cloud Config » Version: 4.1.4

cpe:2.3:a:vmware:spring_cloud_config:4.1.4
Vmware » Spring Cloud Config » Version: 4.1.5

cpe:2.3:a:vmware:spring_cloud_config:4.1.5
Vmware » Spring Cloud Config » Version: 4.1.6

cpe:2.3:a:vmware:spring_cloud_config:4.1.6
Vmware » Spring Cloud Config » Version: 4.1.7

cpe:2.3:a:vmware:spring_cloud_config:4.1.7
Vmware » Spring Cloud Config » Version: 4.2.0

cpe:2.3:a:vmware:spring_cloud_config:4.2.0
Vmware » Spring Cloud Config » Version: 4.2.1

cpe:2.3:a:vmware:spring_cloud_config:4.2.1
Vmware » Spring Cloud Config » Version: 4.2.2

cpe:2.3:a:vmware:spring_cloud_config:4.2.2
Vmware » Spring Cloud Config » Version: 4.2.3

cpe:2.3:a:vmware:spring_cloud_config:4.2.3
Vmware » Spring Cloud Config » Version: 4.2.4

cpe:2.3:a:vmware:spring_cloud_config:4.2.4
Vmware » Spring Cloud Config » Version: 4.3.0

cpe:2.3:a:vmware:spring_cloud_config:4.3.0
Vmware » Spring Cloud Config » Version: 4.3.1

cpe:2.3:a:vmware:spring_cloud_config:4.3.1
Vmware » Spring Cloud Config » Version: 5.0.0

cpe:2.3:a:vmware:spring_cloud_config:5.0.0
Vmware » Spring Cloud Config » Version: 5.0.1

cpe:2.3:a:vmware:spring_cloud_config:5.0.1

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-22739

Products

Pricing

Contact Us