/Vulnerability Library

Spring Framework Path Traversal in Functional Web Frameworks

CVE-2024-38819
Verified

Description

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. The application is vulnerable when it uses RouterFunctions to serve static resources and resource handling is explicitly configured with a FileSystemResource location. This is similar to CVE-2024-38816, but with different input. Unlike CVE-2024-38816, applications deployed on Tomcat or Jetty are also vulnerable.

Severity

High

CVSS Score

7.5

Exploit Probability

56%

Affected Product

spring_framework

Published Date

April 13, 2026

Template Author

dhiyaneshdk

CVE-2024-38819.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2024-38819
CWE ID:
cwe-22

References

https://spring.io/security/cve-2024-38819https://nvd.nist.gov/vuln/detail/CVE-2024-38819https://github.com/masa42/CVE-2024-38819-PoC

Remediation Steps

Implement input validation and sanitize file paths, or update to the latest version of Spring Framework.