PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
high·Product Based Web Vulnerabilities·Updated Apr 13, 2026

Spring Framework Path Traversal in Functional Web Frameworks

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
3.3k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2024-38819
7.5
CVSShigh
Exploitable remotely over the internet · no authentication required.

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
Spring Frameworkby N/A
Spring Framework 5.3.0 - 5.3.40, 6.0.0 - 6.0.24, 6.1.0 - 6.1.13
Updated Sep 9, 2026View on NVD →
Similar Tools
medium
Spring Framework - Path Traversal
→critical
WordPress Simple File List - Path Traversal
→critical
WordPress Madara Theme < 2.2.2.1 - Local File Inclusion
→medium
SAPControl ListConfigFiles - Disclosure
→high
Yonyou YonBIP - Path Traversal
→high
Apache Kafka Client - Arbitrary File Read
→medium
SAPControl Read DEFAULT.PFL - Disclosure
→high
osTicket - Arbitrary File Read
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.