Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-47884: Spring Web MVC may let attackers run code
CVE-2026-47884 · published today
Summary
The Spring Web MVC library used in many Java web applications can be exploited to execute malicious code on the server. This could give an attacker control over the system or access to sensitive data. Apply the latest patches or upgrade to a recent version of the Spring framework to protect your applications.
What to do
- Update org.springframework:spring-webmvc to version 7.0.9.
- Update org.springframework:spring-webmvc to version 4.0.3.RELEASE-aikido.4.
- Update io.root.org.springframework:spring-webmvc to version 4.0.3.RELEASE-root.io.4.
- Update org.springframework:spring-webmvc to version 6.1.11-aikido.4.
- Update io.root.org.springframework:spring-webmvc to version 6.1.11-root.io.4.
- Update org.springframework:spring-webmvc to version 6.1.21-aikido.4.
- Update io.root.org.springframework:spring-webmvc to version 6.1.21-root.io.4.
- Update org.springframework:spring-webmvc to version 6.2.19-aikido.1.
- Update io.root.org.springframework:spring-webmvc to version 6.2.19-root.io.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | spring | spring framework | <= 7.0.8 |
| Ubuntu:Pro:14.04:LTS | canonical | libspring-java | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | libspring-java | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | libspring-java | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | libspring-java | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | libspring-java | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | libspring-java | All versions |
| Ubuntu:26.04:LTS | canonical | libspring-java | All versions |
| Debian:12 | debian | libspring-java | All versions |
| – | vmware | spring_framework |
< 5.2.26 >= 5.3.0, < 5.3.50 >= 6.0.0, < 6.0.31 >= 6.1.0, < 6.1.29 >= 6.2.0, < 6.2.20 >= 7.0.0, < 7.0.8.1 cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* |
| maven | – | org.springframework:spring-webmvc |
<= 5.2.25.RELEASE >= 5.3.0, <= 5.3.49 >= 6.0.0, <= 6.0.30 >= 6.1.0, <= 6.1.28 >= 6.2.0, <= 6.2.19 >= 7.0.0, <= 7.0.8 Fix: upgrade to 7.0.9
|
| Root:Maven | – | org.springframework:spring-webmvc |
< 4.0.3.RELEASE-aikido.4 < 6.1.11-aikido.4 < 6.1.21-aikido.4 < 6.2.19-aikido.1 Fix: upgrade to 4.0.3.RELEASE-aikido.4
|
| Root:Maven | – | io.root.org.springframework:spring-webmvc |
< 4.0.3.RELEASE-root.io.4 < 6.1.11-root.io.4 < 6.1.21-root.io.4 < 6.2.19-root.io.1 Fix: upgrade to 4.0.3.RELEASE-root.io.4
|
Original advisory text
CVE-2026-47884 in org.springframework:spring-webmvc - Patched by Root
Root has patched CVE-2026-47884 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available.
References
- https://www.cve.org/CVERecord?id=CVE-2026-47884 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-47884 Third Party Advisory
- https://spring.io/security/cve-2026-47884 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-47884 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-47884
- https://github.com/spring-projects/spring-framework/commit/692dbc9160de3b5de50cc...
- https://github.com/advisories/GHSA-pc63-qcmh-9cmg
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-22Path Traversal
Timeline
Published14 Oct 2026
Updated14 Oct 2026
First seen27 Aug 2026
Sources
CVE-2026-47884 · NVD
CVE-2026-47884 · MITRE
UBUNTU-CVE-2026-47884 · OSV
DEBIAN-CVE-2026-47884 · OSV
GHSA-pc63-qcmh-9cmg · GHSA
Track software like this
Free during beta