CVE-2026-40982

설명

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade...

영향 제품·버전

제품 Spring Cloud Config, Red Hat Enterprise Linux 8, Red Hat JBoss Enterprise Application Platform Expansion Pack

영향 버전 Spring Cloud Config, Red Hat Enterprise Linux 8, Red Hat JBoss Enterprise Application Platform Expansion Pack >= 3.1.0 < 3.1.14, >= 4.1.0 < 4.1.10, >= 4.2.0 < 4.2.7, >= 4.3.0 < 4.3.3, >= 5.0.0 < 5.0.3

수정 버전 Spring Cloud Config, Red Hat Enterprise Linux 8, Red Hat JBoss Enterprise Application Platform Expansion Pack 3.1.14, 4.1.10, 4.2.7, 4.3.3, 5.0.3

기술 정보

CVSS 벡터 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE CWE-22

EPSS 데이터 기준일 2026.08.02