The flaw permits an attacker to supply an arbitrary view name to XsltView when a wildcard / mapping renders a view without explicit naming, leading to server-side request forgery (SSRF) and potential remote code execution (RCE). The underlying weakness is insufficient validation of the requested view path, allowing the application to load external XSLT documents or execute them within the JVM. An attacker who can influence the view name can trigger calls to arbitrary remote resources or inject malicious XSLT that runs arbitrary code on the host, jeopardizing confidentiality, integrity, and availability of the system.

Versions of Spring Framework from 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier are affected. Applications deploying these releases with wildcard / MVC mappings that allow XsltView rendering are vulnerable.

The vulnerability is externally exploitable through standard HTTP requests matching the / mapping, and the absence of a current EPSS or KEV listing does not diminish the potential impact. Because the flaw allows remote resources to be fetched and executed, an attacker can target vulnerable instances directly over the network. The lack of a published CVSS score should not discourage caution; the RCE capability implies a high severity. Vendors have not released an official fix in the data, so the recommended approach is to eliminate the configuration that permits uncontrolled view names or to upgrade the framework to a version that resolves the flaw.