CVE-2026-59280

About vulnerability

Applications using Spring Framework’s FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Under these conditions, a view name containing backslash sequences can escape the configured template directory, potentially exposing files that should not be accessible.

Returning a view name derived from untrusted input is an application-level anti-pattern that Spring documentation warns against; applications that do not do so are not affected.

Affected product:

Apache CXF , Apache Log4j , Apache Struts , Apache Tomcat , Apache Velocity , Eclipse Jetty , Spring , activemq , amqp-10-jms-spring-boot , artemis , azure-spring-data-cosmos , camel , canal , castor , client_java , cocoon , crash , cypher-dsl , flume , geode , geode-lucene , glassfish-hk2 , gora , grails-async , grails-core , grails-data-mapping , grails-gsp , grails-plugin-converters , hapi-fhir , http-client , ignite , java-cas-client , java-sdk , jersey , jooq , karaf , metrics , micronaut-spring , opencensus-java , org.ops4j.pax.exam , pulsar , resteasy , resteasy-spring , tika

Affected packages:

spring-asm @ 3.1.1.RELEASE (+16093 more)