Spring Framework’s integration with FreeMarker allows template files to be located by a controller through a view name that can contain backslashes. When the SpringTemplateLoader processes such a view name, the backslashes are interpreted as directory separators that escape the intended template directory. This flaw permits an attacker to read arbitrary files on the application server, potentially exposing sensitive configuration, source code, or other confidential data. The vulnerability is a classic path‑traversal weakness that can serve as an initial foothold for further exploitability.

Spring Framework versions 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and any 5.2.25.RELEASE or earlier that employ FreeMarker via SpringTemplateLoader. Any web application that constructs view names from untrusted input and relies on FreeMarker via SpringTemplateLoader is potentially affected.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation evidence. The flaw can be triggered remotely through HTTP requests that supply a malicious view name. Exploitation requires that the application uses FreeMarker with SpringTemplateLoader and permits untrusted input to form the view name. If successful, an attacker can read arbitrary files, compromising confidentiality and possibly enabling further privilege escalation or code execution depending on the accessed resources.