Spring Cloud Config Server exposes static configuration files from directories that lie outside the intended repository path. The flaw allows an attacker to retrieve arbitrary configuration files from the server’s file system, potentially revealing sensitive data such as credentials, connection strings, or internal infrastructure details. The vulnerability is rooted in inadequate path validation; however, the claim of inadequate path validation is inferred from the ability to read files outside the repository and is not explicitly stated in the source data.

The weakness affects Spring Cloud Config Server versions 5.0.0 through 5.0.4, 4.3.0 through 4.3.4, 4.0.0 through 4.2.8, as well as any instance running 3.1.14 or older. These versions run on the Spring framework and are commonly deployed in micro‑service environments where configuration files are served over HTTP.

With a CVSS score of 4.9, the vulnerability presents a moderate risk. The EPSS score is not available, and the issue is not listed in CISA's KEV catalog, implying no known widespread exploitation as of now. The likely attack vector is constructing an HTTP request that includes a path outside the configured repository path, but this exact mechanism is not detailed in the provided description; this inference comes from the stated behavior. Once accessed, the server may return sensitive configuration data. The attack does not require credentials or elevated privileges, making it feasible in an unprotected environment.