The flaw is an XML External Entity (XXE) weakness (CWE‑611) in the JAXP XPath evaluation path used by Spring Web Services. When evaluating XPath expressions over StreamSource or SAXSource objects, the code accidentally parsed the attacker‑controlled XML with the JDK’s default DocumentBuilderFactory settings, which permit external entity resolution. This behavior allows an adversary to inject malicious XML that can reference internal files, trigger network calls, or otherwise cause data disclosure or denial of service during XPath processing.

Spring Web Services is affected. The vulnerability exists in the following release ranges: 3.1.0‑3.1.8, 4.0.0‑4.0.18, 4.1.0‑4.1.3, and 5.0.0‑5.0.1. No other releases are listed as affected in the CVE information, so later versions are not confirmed as vulnerable.

The CVSS score of 8.2 indicates high severity. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely known public exploits yet. The likely attack vector is remote, as the vulnerability is triggered when a Spring application receives XML payloads that it evaluates with XPath. Successful exploitation could enable attackers to read sensitive files, exfiltrate data, or trigger a denial of service under suitable circumstances.