Spring Framework constructs the Content‑Disposition header from data supplied by the client without proper sanitization. When an attacker supplies a malicious file name containing CRLF sequences, the header can be split, allowing the injection of additional HTTP headers and alteration of the response body. The lack of input validation enables an attacker to manipulate the response sent to the client, and based on the description, it is inferred that this can likely be performed without privileged access or authentication.

Vulnerable releases of the Spring Framework include 7.0.0 through 7.0.8, 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30, 5.3.0 through 5.3.49, and all releases 5.2.25.RELEASE and earlier. All affected versions employ the same header‑building code path that is susceptible to the described injection.

The CVSS score is 3.7 and the EPSS score is <1%, indicating a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack can be carried out by any user who can trigger a download response with a crafted file name, and it is likely that no authentication or privilege escalation is required, although the CVE description does not explicitly state this prerequisite.