Spring Cloud Function is vulnerable to an arbitrary file read and server‑side request forgery (SSRF). An attacker who can invoke the vulnerable function may read any file that the function’s runtime process can access, including sensitive configuration and credential files, and may trigger requests to internal network resources or other services controlled by the host. The consequence is a confidentiality breach and potential lateral movement within the infrastructure.

The affected versions are Spring Cloud Function 4.2.0 through 4.2.7, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.3. These versions are used by developers who deploy the function as a microservice or serverless component.

The CVSS score of 2.0 indicates a low base severity, and the EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker’s access vector is via a function invocation endpoint that accepts a file path or URL parameter; no authentication or privileged state is explicitly required, suggesting that any user with network reach to the endpoint could exploit it. The lack of a high CVSS score and absence of an EPSS score suggest that while exploitation is possible, active attacks are unlikely to be widespread at present.