CVE-2026-47894

Summary

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

Affected Software

VendorProductVersion RangeStatus
SpringSpring Cloud Config5.0.0 <= 5.0.4affected
SpringSpring Cloud Config4.3.0 <= 4.3.4affected
SpringSpring Cloud Config4.0.0 <= 4.2.8affected
SpringSpring Cloud Config0 <= 3.1.14affected

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References