AIKIDO-2026-10771
spring-cloud-config-server is vulnerable to Path Traversal
91
Critical Risk
This Affects:
spring-cloud-config-serverTL;DR
Spring Cloud Config allows applications to server arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
spring-cloud-config-server is vulnerable to Path Traversal in versions 0.0.1 - 3.1.13, 4.0.0 - 4.1.9, 4.2.0 - 4.2.6, 4.3.0 - 4.3.2 and 5.0.0 - 5.0.2.
How to fix this
Upgrade the org.springframework.cloud:spring-cloud-config-server library to a patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant