Spring Framework <7.0.8 Open Redirect via UrlFileNameViewController
CVE-2026-47887 Published on August 27, 2026
Spring Framework Open Redirect in UrlFileNameViewController
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Products Associated with CVE-2026-47887
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring Framework:- Version 7.0.0, <= 7.0.8 is affected.
- Version 6.2.0, <= 6.2.19 is affected.
- Version 6.1.0, <= 6.1.28 is affected.
- Version 6.0.0, <= 6.0.30 is affected.
- Version 5.3.0, <= 5.3.49 is affected.
- Before and including 5.2.25.RELEASE is affected.