CVE-2026-40987

Vulnerability

The vulnerability is a path traversal issue in Spring Integration's remote-file synchronizer when connecting to FTP/SFTP/SMB servers. The client writes files using server-supplied filenames without canonicalization, allowing a malicious server to write files outside the configured local directory. Affected versions: Spring Integration 7.0.0-7.0.4, 6.5.0-6.5.8, 6.4.0-6.4.11, 6.3.0-6.3.14, 5.5.0-5.5.20. [1]

Exploitation

An attacker must control a FTP/SFTP/SMB server that the client connects to. The server returns a filename containing path traversal sequences (e.g., "../") that the client does not sanitize, causing the file to be written outside the intended directory. No special authentication is required beyond the attacker being able to influence the filename sent to the client. [1]

Impact

Successful exploitation allows an attacker to write arbitrary files with controlled content anywhere on the client filesystem, potentially leading to remote code execution or system compromise. The CVSS score is 7.1 (High). [1]

Mitigation

Upgrade to fixed versions: 5.5.21, 6.3.15, 6.4.12, 6.5.8.1 or 6.5.9, 7.0.4.1 or 7.0.5 depending on support tier. No other mitigations are necessary. [1]