Advisory details:
github_osv / GHSA-r936-gwx5-v52f
| Advisory ID | github_osv/GHSA-r936-gwx5-v52f |
| Aliases |
CVE-2025-41242
|
| Summary | Spring Framework MVC Applications Path Traversal Vulnerability Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 5.3 |
| Risk | 2.6 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 5.9 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-r936-gwx5-v52f/GHSA-r936-gwx5-v52f.json |
| generic_textual | MODERATE |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/spring-projects/spring-framework | ||
| cve-2025-41242 | Other | http://spring.io/security/cve-2025-41242 |
| CVE-2025-41242 | https://nvd.nist.gov/vuln/detail/CVE-2025-41242 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-08-18T11:20:32Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/41xxx/CVE-2025-41242.json
Source Advisory: vulnrichment/CVE-2025-41242
[{'Exploitation': 'none'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]