CVE-2024-38819: Path Traversal in Spring Webflux

The core of this vulnerability lies in how Spring Webflux handles static resource requests through its functional web frameworks, WebMvc.fn and WebFlux.fn. An attacker can exploit this by manipulating the request path to bypass intended access controls. This allows them to read arbitrary files accessible to the Spring application's process, potentially including configuration files, source code, or even sensitive data like database credentials. The blast radius is significant, as successful exploitation could lead to complete compromise of the server and its data. While no direct precedent is immediately obvious, the underlying mechanism shares similarities with other path traversal vulnerabilities where improper input validation allows access to unauthorized resources.

1. Reserved2024-06-19
2. Published2024-12-19
3. Modified2025-05-28
4. EPSS updated2026-04-02

The primary mitigation is to upgrade to Spring Webflux version 6.1.14 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing a Web Application Firewall (WAF) or reverse proxy with rules to filter out malicious path traversal attempts. Specifically, look for patterns involving directory traversal sequences like ../ or encoded equivalents. Additionally, review your application's static resource configuration to ensure that access controls are properly enforced and that only authorized files are served. After upgrading, verify the fix by attempting to access a file outside the intended static resource directory using a crafted HTTP request; the request should be denied.