Spring Cloud Config Server provides configuration data to micro‑service clients. A flaw in the handling of the native environment repository allows the resolved file path to point outside the intended repository directory. Based on the description, it is inferred that an attacker can retrieve arbitrary files from the server’s file system by crafting specially constructed HTTP paths. The exposed data may include database credentials, API keys, and other sensitive configuration information, leading to confidentiality loss.

Spring Cloud Config Server versions 5.0.0 through 5.0.4, 4.3.0 through 4.3.4, 4.0.0 through 4.2.8, and all releases 3.1.14 or earlier are affected.

The CVSS score of 4.9 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated HTTP request that includes a path capable of traversing outside the configured repository. If the Config Server is exposed to untrusted networks, the server may return the contents of any accessible file, potentially exposing sensitive data.