The flaw permits an attacker to supply an arbitrary view name to XsltView when a wildcard / mapping renders a view without explicit naming, leading to server‑side request forgery (SSRF) and potential remote code execution (RCE). The underlying weakness is insufficient validation of the requested view path, a path traversal issue (CWE-22), allowing the application to load external XSLT documents or execute them within the JVM. An attacker who can influence the view name can trigger calls to arbitrary remote resources or inject malicious XSLT that runs arbitrary code on the host, jeopardizing confidentiality, integrity, and availability of the system.

Versions of Spring Framework from 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier are affected. Applications deploying these releases with wildcard / MVC mappings that allow XsltView rendering are vulnerable.

The vulnerability is externally exploitable through standard HTTP requests matching the / mapping, and the EPSS score of < 1% indicates a low likelihood of widespread exploitation. The CVSS score of 9.8 demonstrates a critical severity, confirming that remote resources can be fetched and executed. An attacker can target vulnerable instances directly over the network. Because RCE is possible, the impact is high. Vendors have not released an official fix in the data, so the recommended approach is to eliminate the configuration that permits uncontrolled view names or to upgrade the framework to a version that resolves the flaw.