The vulnerability allows the use of Java scripting engines such as JRuby or Jython in Spring MVC and WebFlux template views to read files outside the configured template directories. This can expose sensitive application configuration, source code, or other private files, leading to a confidentiality breach. The weakness is a path traversal or improper path validation, identified as CWE-22.

Affected versions of Spring Framework include 5.3.0 through 5.3.46, 6.1.0 through 6.1.25, 6.2.0 through 6.2.16, and 7.0.0 through 7.0.5. The product is the Spring Framework from the Spring vendor.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog, implying no known active exploitation. Based on the description, the likely attack vector is an application that supports script template views; an attacker with access to the application can supply a malicious template path to read arbitrary files. Mitigation requires application configuration changes or patching.