CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.
An application can be vulnerable when all the following are true:
the application is deployed as a WAR or with an embedded Servlet container the Servlet container does not reject suspicious sequences
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41242?
CVE-2025-41242 has been classified with a high severity due to its potential to expose sensitive files in Spring Framework MVC applications.
How do I fix CVE-2025-41242?
To fix CVE-2025-41242, ensure that your application is deployed in a compliant Servlet container and properly validate user inputs.
Which applications are affected by CVE-2025-41242?
CVE-2025-41242 affects Spring Framework MVC applications deployed on non-compliant Servlet containers like Apache Tomcat and Eclipse Jetty.
What types of attacks can exploit CVE-2025-41242?
CVE-2025-41242 can be exploited through path traversal attacks, allowing attackers to access unauthorized file system locations.
Is CVE-2025-41242 relevant only to specific versions of Spring Framework?
CVE-2025-41242 is applicable to any version of Spring Framework that is deployed in a vulnerable configuration on a non-compliant Servlet container.