CVE-2026-22737

{"id": "CVE-2026-22737", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2026-03-20T00:16:15.837", "references": [{"url": "https://spring.io/security/cve-2026-22737", "source": "security@vmware.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views.\u00a0This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46."}, {"lang": "es", "value": "El uso de vistas de plantilla con motor de scripting de Java habilitado (p. ej., JRuby, Jython) en aplicaciones Spring MVC y Spring WebFlux puede resultar en la divulgaci\u00f3n de contenido de archivos fuera de las ubicaciones configuradas para las vistas de plantilla de script. Este problema afecta a Spring framework: de 7.0.0 a 7.0.5, de 6.2.0 a 6.2.16, de 6.1.0 a 6.1.25, de 5.3.0 a 5.3.46."}], "lastModified": "2026-03-20T15:16:16.047", "sourceIdentifier": "security@vmware.com"}