AIKIDO-2026-247148
spring-cloud-config-server is vulnerable to Path Traversal
49
Medium Risk
This Affects:
spring-cloud-config-serverTL;DR
spring-cloud-config-server native environment repository can expose configuration files outside the configured repository path. A high-privilege requester can read files that should stay outside the config repo. That can disclose secrets from the server filesystem. The patch keeps native repository reads inside the configured path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the native environment repository is used on Config Server.
Background info
spring-cloud-config-server is vulnerable to Path Traversal in versions 0.0.1 - 5.0.4.
How to fix this
Upgrade the org.springframework.cloud:spring-cloud-config-server library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant