CVE-2026-47887mediumCWE-601

CVE-2026-47887: fallo de gravedad media en Spring Framework

Spring Framework Open Redirect in UrlFileNameViewController

Publicada el

Seguir esta CVE+ Monitorear Spring Framework+ Monitorear libspring-java

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.2%
A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Spring · Spring Framework
CVEs relacionadas — Spring Framework

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-5398HIGHRFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux ApplicationEPSS 88.3%CVE-2024-22243HIGHCVE-2024-22243: Spring Framework URL Parsing with Host ValidationEPSS 4.0%CVE-2024-22259HIGHCVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)EPSS 2.6%CVE-2020-5397MEDIUMCSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFluxEPSS 2.6%CVE-2024-22262HIGHCVE-2024-22262: Spring Framework URL Parsing with Host ValidationEPSS 1.2%CVE-2023-34053MEDIUMSpring Framework server Web Observations DoS VulnerabilityEPSS 1.2%