CVE-2026-47884Critical· 9.8▾ AbyssalPoC availableUse of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spr…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
1 GitHub repo
0.4% → 0.6%
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
spring_framework < 5.2.26spring_framework >= 5.3.0, < 5.3.50spring_framework >= 6.0.0, < 6.0.31spring_framework >= 6.1.0, < 6.1.29spring_framework >= 6.2.0, < 6.2.20spring_framework >= 7.0.0, < 7.0.8.1Upgrade past the affected range:
spring_framework 7.0.8.1Affected packages:
org.springframework:spring-webmvc <= 5.2.25.RELEASEorg.springframework:spring-webmvc >= 5.3.0, <= 5.3.49org.springframework:spring-webmvc >= 6.0.0, <= 6.0.30org.springframework:spring-webmvc >= 6.1.0, <= 6.1.28org.springframework:spring-webmvc >= 6.2.0, <= 6.2.19org.springframework:spring-webmvc >= 7.0.0, <= 7.0.8Patched in:
org.springframework:spring-webmvc 7.0.9Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-22971Medium· 6.5In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
CVE-2020-5398High· 7.5In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in…
CVE-2022-22968Medium· 5.3In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with b…
CVE-2026-47883Medium· 6.1UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns
CVE-2018-11040High· 7.5Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for R…
CVE-2026-47885High· 7.5The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28