CVE-2026-40987 Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem
A malicious remote server can write arbitrary files to the client filesystem via path traversal in Spring Integration's file synchronizer, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-40987?
CVE-2026-40987 is a high-severity path traversal vulnerability in Spring Integration, published on 11 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.
Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.
Weakness: CWE-22
Which versions are affected by CVE-2026-40987?
10 open source packages ship an affected version, including org.springframework.integration:spring-integration-file. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.integration:spring-integration-file Maven | All versions to 5.5.20 | None |
org.springframework.integration:spring-integration-file Maven | All versions to 5.5.20 | None |
org.springframework.integration:spring-integration-file Maven | From 6.3.0 to 6.3.14 | None |
org.springframework.integration:spring-integration-file Maven | From 6.3.0 to 6.3.14 | None |
org.springframework.integration:spring-integration-file Maven | From 6.4.0 to 6.4.11 | None |
org.springframework.integration:spring-integration-file Maven | From 6.4.0 to 6.4.11 | None |
4 more packages
org.springframework.integration:spring-integration-file Maven | From 6.5.0 | 6.5.9 |
org.springframework.integration:spring-integration-file Maven | From 6.5.0 | 6.5.9 |
org.springframework.integration:spring-integration-file Maven | From 7.0.0 | 7.0.5 |
org.springframework.integration:spring-integration-file Maven | From 7.0.0 | 7.0.5 |
Products include Vmware Spring Integration.
How do I fix CVE-2026-40987?
Upgrade org.springframework.integration:spring-integration-file to a fixed version for your release line: 6.5.9 or 7.0.5.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40987 being exploited?
There is no known exploitation of CVE-2026-40987 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Spring Integration
- CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
- CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
- CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
- CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1
- CVE-2026-59274 Unbounded decompression in UnZipTransformer enables zip-bomb DoS
Sources
Also known as CLSA-2026-1785380362, CLSA-2026-1788470094, CLSA-2026-1791488248, GHSA-792x-6vq6-j8r9, ROOT-APP-MAVEN-CVE-2026-40987.