A flaw in Spring MVC and WebFlux allows the resolution of static resources to leak application information. The vulnerability arises when the static resource cache interacts with resource handler mappings, enabling an attacker to discover file names, paths, or other internal details that should not be publicly exposed. This constitutes a confidentiality breach, exposing potentially sensitive data such as source file locations or configuration hints.

The issue affects the Spring Framework across multiple major releases: 5.3.0 to 5.3.48, 6.1.0 to 6.1.27, 6.2.0 to 6.2.18, and 7.0.0 to 7.0.7. The advisory is relevant for all projects that rely on the Spring Framework for handling web requests via Spring MVC or the reactive WebFlux module.

The CVSS score of 5.9 indicates a moderate severity and the public availability of no EPSS data suggests the exploit likelihood is currently unknown. The vulnerability is remote, accessible over HTTP, and does not require authentication per the description. Although it is not listed in CISA’s KEV catalog, the potential for exposing internal paths makes it a concern for organizations handling sensitive or regulated data.