Spring MVC and WebFlux applications may allow attackers to perform path traversal when resolving versioned static resources. The vulnerability is triggered by crafting URLs that map to internal files outside the intended web root. If successful, it can expose any file readable by the application process, potentially leaking sensitive configuration or source code. This flaw is categorized as CWE‑22, reflecting improper path handling.

Affected versions include Spring Framework 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. The core issue is present in the static resource resolver for both MVC and WebFlux modules across these releases.

The CVSS score is 5.9, indicating moderate severity. EPSS is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV. The path traversal could be achieved by any user who can send a request to the application, so authentication is not required. Attackers may abuse the flaw without additional privileges, making the risk context‑dependent on the application’s exposure to external traffic. Organizations should treat this as a moderate risk until a fix is applied.