Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.springframework/spring-webmvc@5.3.43
purl pkg:maven/org.springframework/spring-webmvc@5.3.43
Tags Ghost
Next non-vulnerable version 6.0.14
Latest non-vulnerable version 7.0.6
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-n1vf-acj7-gkaf
Aliases:
CVE-2025-41242
GHSA-r936-gwx5-v52f
Spring Framework MVC Applications Path Traversal Vulnerability Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.
6.2.10
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-07T04:58:27.168290+00:00 GHSA Importer Affected by VCID-n1vf-acj7-gkaf https://github.com/advisories/GHSA-r936-gwx5-v52f 38.1.0