Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-amw7-64u1-nbdh
Vulnerability ID VCID-amw7-64u1-nbdh
Aliases CVE-2024-38816
GHSA-cx7f-g6mp-7hqm
Summary Path traversal vulnerability in functional web frameworks Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running. Specifically, an application is vulnerable when both of the following are true: * the web application uses RouterFunctions to serve static resources * resource handling is explicitly configured with a FileSystemResource location However, malicious requests are blocked and rejected when any of the following is true: * the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use * the application runs on Tomcat or Jetty
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38816.json
epss 0.9389 https://api.first.org/data/v1/epss?cve=CVE-2024-38816
epss 0.9389 https://api.first.org/data/v1/epss?cve=CVE-2024-38816
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-cx7f-g6mp-7hqm
cvssv3.1 7.5 https://github.com/spring-projects/spring-framework
generic_textual HIGH https://github.com/spring-projects/spring-framework
cvssv3.1 7.5 https://github.com/spring-projects/spring-framework/commit/d86bf8b2056429edf5494456cffcb2b243331c49
generic_textual HIGH https://github.com/spring-projects/spring-framework/commit/d86bf8b2056429edf5494456cffcb2b243331c49
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-38816
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-38816
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20241227-0001
generic_textual HIGH https://security.netapp.com/advisory/ntap-20241227-0001
cvssv3.1 7.5 https://spring.io/security/cve-2024-38816
generic_textual HIGH https://spring.io/security/cve-2024-38816
ssvc Track https://spring.io/security/cve-2024-38816
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38816.json
https://api.first.org/data/v1/epss?cve=CVE-2024-38816
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38816
https://github.com/spring-projects/spring-framework
https://github.com/spring-projects/spring-framework/commit/d86bf8b2056429edf5494456cffcb2b243331c49
https://security.netapp.com/advisory/ntap-20241227-0001
2312060 https://bugzilla.redhat.com/show_bug.cgi?id=2312060
CVE-2024-38816 https://nvd.nist.gov/vuln/detail/CVE-2024-38816
CVE-2024-38816 https://spring.io/security/cve-2024-38816
GHSA-cx7f-g6mp-7hqm https://github.com/advisories/GHSA-cx7f-g6mp-7hqm
RHSA-2024:8064 https://access.redhat.com/errata/RHSA-2024:8064
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38816.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/spring-projects/spring-framework
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/spring-projects/spring-framework/commit/d86bf8b2056429edf5494456cffcb2b243331c49
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-38816
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://security.netapp.com/advisory/ntap-20241227-0001
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://spring.io/security/cve-2024-38816
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-13T13:40:55Z/ Found at https://spring.io/security/cve-2024-38816
Exploit Prediction Scoring System (EPSS)
Percentile 0.99884
EPSS Score 0.9389
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:22:15.788061+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-webmvc/CVE-2024-38816.yml 38.6.0