CVE-2026-47862 ZipTransformer uses file_name header to build workDirectory path without sanitization

What is CVE-2026-47862?

CVE-2026-47862 is a medium-severity path traversal vulnerability in Spring Integration, published on 26 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

Weakness: CWE-22

Which versions are affected by CVE-2026-47862?

It affects 1 product.

Products include Vmware Spring Integration.

How do I fix CVE-2026-47862?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-47862 being exploited?

There is no known exploitation of CVE-2026-47862 in the wild and no public exploit code.

Other vulnerabilities in Spring Integration

• CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction High 8.2
• CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference High 8.0
• CVE-2026-40987 Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem High 7.1
• CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation Medium 6.8
• CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1 Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-893m-8v6w-f7gr.