CVE-2020-5405 Directory Traversal with spring-cloud-config-server
Attackers can read arbitrary configuration files via directory traversal in Spring Cloud Config Server, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5405?
CVE-2020-5405 is a medium-severity path traversal vulnerability in Spring Cloud Config, published on 5 Mar 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Which versions are affected by CVE-2020-5405?
4 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-config-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-config-server Maven | From 2.1.0 | 2.1.7 |
org.springframework.cloud:spring-cloud-config-server Maven | From 2.1.0 | 2.1.7 |
org.springframework.cloud:spring-cloud-config-server Maven | From 2.2.0 | 2.2.2 |
org.springframework.cloud:spring-cloud-config-server Maven | From 2.2.0 | 2.2.2 |
Products include Vmware Spring Cloud Config.
How do I fix CVE-2020-5405?
Upgrade org.springframework.cloud:spring-cloud-config-server to a fixed version for your release line: 2.1.7 or 2.2.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-5405 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-5405 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Spring Cloud Config
- CVE-2020-5410 VMware Tanzu Spring Cloud Config Directory Traversal
- CVE-2026-40982 Spring Cloud Config vulnerable to Path Traversal
- CVE-2026-22739 Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks
- CVE-2026-40981 Spring Cloud Config has an Authorization Bypass Through User-Controlled Key
- CVE-2026-41002 Spring Cloud Config Server Susceptible To TOCTOU Attack
Sources
Also known as GHSA-g86w-v5vg-9gxf.