The vulnerability allows a malicious or compromised FTP, SFTP, or SMB server to cause Spring Integration's remote-file synchronizer to write files under a specified local directory using a filename supplied by the server. Because the filename is not canonicalized, an attacker can manipulate the path to write arbitrary files outside the intended directory, potentially overwriting critical system files or placing malicious code on the client machine, which can enable remote code execution or privilege escalation.

Spring Integration versions 7.0.0 through 7.0.4, 6.5.0 through 6.5.8, 6.4.0 through 6.4.11, 6.3.0 through 6.3.14, and 5.5.0 through 5.5.20 are affected. The flaw is triggered when the remote-file synchronizer component is used with an insecure remote server.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, so the current likelihood of exploitation is unknown, but the widespread affected versions and the ability to exploit the flaw whenever the synchronizer connects to an attacker‑controlled server raise concern. The issue is not listed in the CISA KEV catalog, yet the potential for remote code execution warrants monitoring and rapid remediation.