CVE-2026-22737 Security Details

CVE ID

CVE-2026-22737

CWE

CWE-22

CVE Description

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Published

Mar 20, 2026

CVSS Score & Severity

8.2High

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.096%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/web/reactive/result/view/script/ScriptTemplateView.getResource(Ljava/lang/String;)Lorg/springframework/core/io/Resource;

JVMVulnerable params: 0

org/springframework/web/servlet/view/script/ScriptTemplateView.getResource(Ljava/lang/String;)Lorg/springframework/core/io/Resource;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT