A Spring MVC application that configures the UrlFileNameViewController without a prefix and with an end‑of‑path mapping is vulnerable to an open redirect. The flaw allows an attacker to craft a URL that causes the application to send the user’s browser to an arbitrary external site, which can be leveraged for phishing, credential harvesting or other social‑engineering attacks. While it does not provide code execution or direct data disclosure, the loss of redirect control can undermine user trust and enable secondary attacks.

Spring Framework versions 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and any 5.2.25.RELEASE or earlier release are affected if UrlFileNameViewController is mapped with an end‑of‑path and has no configured prefix.

The CVSS score of 6.1 indicates a moderate impact. The EPSS score is less than 1%, suggesting a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a web request containing a malicious redirect target; it can be exercised over any network path from which the application is reachable. The flaw remains exploitable if the application continues to expose the vulnerable controller mapping.