CVE-2026-22739: VMware Spring Cloud Config

High severity, CVSS 8.6. EPSS: 1.2% chance of exploitation in the next 30 days.

Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.

Affected products

• VMware Spring Cloud Config: before 3.1.13 (fixed in 3.1.13); from 4.1.0, before 4.1.9 (fixed in 4.1.9); from 4.2.0, before 4.2.6 (fixed in 4.2.6); from 4.3.0, before 4.3.2 (fixed in 4.3.2); from 5.0.0, before 5.0.2 (fixed in 5.0.2)

Published 2026-03-24. Last modified 2026-09-04.