5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-41242

CVE-2025-41242: Spring Framework MVC Applications Path Traversal Vulnerability

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

the application is deployed as a WAR or with an embedded Servlet container
the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization
the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling

We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-41242

CVE-2025-41242:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springframework:spring-webmvc	maven	>= 6.2.0, < 6.2.10	6.2.10
org.springframework:spring-webmvc	maven	>= 6.1.0, <= 6.1.21
org.springframework:spring-webmvc	maven	>= 6.0.0, <= 6.0.29
org.springframework:spring-webmvc	maven	>= 5.3.0, <= 5.3.43

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in Spring Framework's MVC module, specifically when handling static resources on non-compliant servlet containers. The root cause is improper handling of URI-encoded path segments.

My analysis began by identifying the patched version, 6.2.10, and comparing it against the last known vulnerable version, 6.2.9, to find the security fix. Among the commits between these versions, one stood out: "Refine StringUtils#uriDecode and update documentation" (24e66b63d1d12c45e4af333d6271451083f81e90).

This commit significantly refactors the uriDecode method in org.springframework.util.StringUtils. The previous implementation was complex and handled percent-encoding in a way that could be bypassed with specially crafted input. The new implementation is more robust and uses modern Java APIs for hexadecimal decoding, which is less prone to errors.

The vulnerability manifests when a component like ResourceHttpRequestHandler (responsible for serving static resources) uses this decoding function to process a request's path. On a non-compliant servlet container, malicious input like /%252e%252e/ (double-encoded ../) might be passed to the application. The flawed uriDecode function could improperly decode this sequence, leading to a path traversal attack.

Therefore, org.springframework.util.StringUtils.uriDecode is identified as the core vulnerable function because it contains the flawed logic that processes the malicious input. org.springframework.web.util.UriUtils.decode is also identified as it is a direct public wrapper in the spring-web module, making it a likely candidate to appear in a runtime profile during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.