Arbitrary Code Injection Affecting org.springframework:spring-webmvc package, versions [,7.0.9)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Arbitrary Code Injection vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-ORGSPRINGFRAMEWORK-19267098
- published26 Aug 2026
- disclosed20 Aug 2026
- creditUnknown
Introduced: 20 Aug 2026
NewCVE-2026-47884 (opens in a new tab)How to fix?
Upgrade org.springframework:spring-webmvc to version 7.0.9 or higher.
Overview
org.springframework:spring-webmvc is a package that provides Model-View-Controller (MVC) architecture and ready components that can be used to develop flexible and loosely coupled web applications.
Affected versions of this package are vulnerable to Arbitrary Code Injection via the XsltView file when an application has a /** mapping that results in view rendering and the view name is not explicitly specified. An attacker can execute arbitrary code or make unauthorized network requests by supplying crafted input to manipulate the view resolution process.
Note: This is only exploitable if the application is configured with a /** mapping that triggers view rendering without explicitly specifying the view name.