Medium severity · published Mar 19, 2026
CVE-2026-22737
Spring Framework Improper Path Limitation with Script View Templates
5.9
CVSS
0.4%
EPSS
No
On KEV
Description
Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Spring Framework · Spring
7.0.0 through 7.0.5; 6.2.0 through 6.2.16; 6.1.0 through 6.1.25; 5.3.0 through 5.3.46 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22737
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22737
Vendor Advisory
https://spring.io/security/cve-2026-22737
More from Spring Framework
9.8
CVE-2026-59313
Server Sent Event stream corruption in Spring MVC functional web framework
9.8
CVE-2026-47892
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
9.8
CVE-2026-47891
Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
9.8
CVE-2026-47890
Spring Framework Server Sent Event stream corruption while rendering fragments
9.8
CVE-2026-47884
Spring Framework Improper Path Limitation in XsltView