Spring Cloud Config enables applications to serve arbitrary text and binary files via the spring-cloud-config-server module. A specially crafted URL can trigger a directory traversal exploit, allowing an attacker to access and download files outside the intended configuration directory. The flaw directly compromises confidentiality by exposing potentially sensitive files on the server, and could enable further attacks if those files contain secrets or executable code.

The affected product is Spring Cloud Config. Versions vulnerable include 3.1.0 through 3.1.13, 4.1.0 through 4.1.9, 4.2.0 through 4.2.6, 4.3.0 through 4.3.2, and 5.0.0 through 5.0.2. All affected releases use the spring-cloud-config-server module. Users on Enterprise Support configurations should upgrade to 3.1.14 or later, 4.1.10 or later, 4.2.7 or later, 4.3.3 or later, and 5.0.3 or later, respectively.

The vulnerability carries a CVSS score of 9.1, indicating a high severity. The EPSS score is not available, but the lack of a KEV listing does not diminish the potential impact. The attack requires sending a crafted request to the Config Server over the network; the exploit can be performed by any user who can reach the server’s endpoint. Because the flaw allows reading of arbitrary files, an adversary could acquire confidential data or use the information to facilitate additional attacks. Given the high CVSS score and the ability to exploit the flaw remotely, the risk is significant.