Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.springframework.integration:spring-integration-file

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.1MavenPublished

    Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem

    CVE-2026-40987 · GHSA-792x-6vq6-j8r9

    Affected
    • Maven org.springframework.integration:spring-integration-file >= 6.4.0, <= 6.4.11; >= 6.3.0, <= 6.3.14; <= 5.5.20; >= 7.0.0, <= 7.0.4; >= 6.5.0, <= 6.5.8
    Fixed in
    6.5.97.0.5· Partial vendor fix
    Issue
    A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

    Recommended action: Upgrade to 7.0.5 or 6.5.9 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →