The vulnerability is a time‑of‑check, time‑of‑use race condition in the Spring Cloud Config Server’s handling of the configuration file used to clone SVN repositories. In the race, an attacker could influence the directory used by the server between the check that the path is safe and the use that performs the clone or subsequent operations, allowing unauthorized code or configuration changes. The weakness is classified as a race condition and is reflected in the CVSS score of 7.2.

Spring Cloud Config versions 5.0.0 through 5.0.4, 4.3.0 through 4.3.4, 4.0.0 through 4.2.8, and 3.1.14 and earlier are affected. The issue manifests when the server uses SVN to clone repositories, so any installation of these versions that exposes this feature is vulnerable until patched.

The CVSS score of 7.2 denotes moderate to high severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require an attacker who can influence the system’s file system between the directory check and the clone operation—such as by writing to the base directory or by manipulating the repository content. The risk is greatest for deployments that trust all SVN sources or expose the configuration server to unauthenticated clients; patching is strongly recommended.