Spring Integration CVE-2026-40987: Path Traversal via Malicious Remote File Server — Quick Look

Introduction

Spring Integration's remote file synchronizer skips a filename canonicalization step. Because of that, a malicious or compromised FTP, SFTP, or SMB server can write files with attacker-controlled content to arbitrary locations on the client filesystem, well outside the intended download directory. Five concurrent release lines are affected (spanning versions 5.5.0 through 7.0.4), and over half of Fortune 500 companies trust Spring, so CVE-2026-40987 is a significant exposure for enterprise Java environments that rely on automated file synchronization workflows.

Spring Integration is an open-source framework for enterprise application integration that implements the well-known Enterprise Integration Patterns (EIPs) within the Spring ecosystem. It provides protocol-specific adapters for FTP, SFTP, SMB, and other integration protocols, and Java enterprise environments use it widely for asynchronous messaging, data transformation, and remote file processing.

Technical Information

Root Cause: Missing Filename Canonicalization

CVE-2026-40987 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The vulnerable component is the InboundFileSynchronizer, which synchronizes files from remote FTP, SFTP, or SMB servers to a locally configured localDirectory.

When the synchronizer polls a remote server for new files, it accepts the filename that server supplies and writes the file under localDirectory without resolving the pathname to its absolute, normalized form. Canonicalization would reveal whether a server-supplied filename contains traversal sequences like ../ that escape the intended directory boundary. Without it, the synchronizer trusts the remote filename implicitly.

Per the MITRE CWE definition, CWE-22 occurs "when software constructs a pathname from external input without properly neutralizing special elements," allowing attackers to escape the intended restricted directory using elements such as ".." and "/" separators. Here, the external input is the filename the remote server provides during the file transfer protocol exchange.

CVSS Vector Analysis

The CVSS v3.1 vector is AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L, yielding a score of 7.1 (HIGH).

Three parts of the vector stand out.

Changed Scope (S:C): The flaw sits in the Spring Integration synchronizer component, but it affects resources beyond that component's own security authority. The integrity violation reaches past the application's data directory to any writable location on the host filesystem.

High Integrity Impact (I:H): Arbitrary file writes with attacker-controlled content can overwrite critical system or application files. Depending on the host's configuration and the application's filesystem permissions, an attacker could target SSH authorized_keys files, cron job configurations, application properties, or executable binaries, which could lead to remote code execution or persistent backdoor access.

High Attack Complexity (AC:H) and User Interaction Required (UI:R): The attacker must either control or compromise the remote server, and the Spring Integration application must initiate a synchronization cycle. However, many production deployments poll on an automated schedule, so the "user interaction" may happen with no human involved once the polling interval triggers.

Exploitation Scenarios

Scenario 1: Malicious Server. An attacker sets up a rogue FTP, SFTP, or SMB server and gets the Spring Integration application to connect to it through misconfiguration, DNS hijacking, or social engineering. When the InboundFileSynchronizer polls this server, the server responds with filenames containing path traversal sequences (for example, ../../../etc/cron.d/malicious_job). The synchronizer writes the file to the traversed path instead of confining it to localDirectory.

Scenario 2: Compromised Legitimate Server. An attacker compromises a legitimate remote server that the application already trusts, then renames the files hosted there to include traversal sequences. The next synchronization cycle downloads those files to unintended locations on the client filesystem. This matches the supply-chain attack pattern, in which an attacker turns trust in a legitimate upstream source against the client.

Both scenarios affect all three protocol adapters (FTP, SFTP, and SMB) because they share the same underlying InboundFileSynchronizer logic. The attack works over each of these file transfer protocols, all of which are common in enterprise integration workflows.

Impact Escalation

The ability to write arbitrary files with attacker-controlled content is a well-understood escalation primitive. Depending on the host environment and the privileges under which the Spring Integration application runs, an attacker could:

• Overwrite SSH authorized_keys to gain persistent remote access
• Plant cron jobs or systemd service files for scheduled code execution
• Replace application configuration files to redirect data flows or inject credentials
• Overwrite executable binaries or libraries loaded by other processes

Affected Systems and Versions

Five concurrent Spring Integration release lines are affected:

Organizations running the 6.4.x, 6.3.x, and 5.5.x lines face a gap. Open-source patches are only available for the two most recent release lines (7.0.x and 6.5.x), so anyone on an older version needs a Tanzu Spring enterprise subscription to get a patch. That leaves older, potentially more entrenched deployments with a longer exposure window.

Any application using the FTP Inbound Channel Adapter, SFTP Inbound Channel Adapter, or SMB Inbound Channel Adapter with the InboundFileSynchronizer is vulnerable if it connects to a server that could be malicious or compromised.

Vendor Security History

CVE-2026-40987 arrives during an unprecedented period of security activity in the Spring ecosystem. Broadcom reported a 1700% surge in monthly security advisories submitted by the Spring community between March and April 2026, attributed partly to the increasing use of AI to discover software flaws. The surge prompted what Broadcom described as the largest set of security updates in Spring's 23-year history.

Other notable Spring advisories published alongside or near CVE-2026-40987 include:

Three external researchers, M0untainShley, SharlongWen, and daehyuh, discovered and responsibly disclosed the vulnerability. The VMware security team ([email protected], now under Broadcom) coordinated the advisory, which was published on June 10, 2026. The NVD entry followed on June 11, 2026.

Broadcom has responded to the broader advisory surge by investing in day-zero, CVE-only patches for enterprise customers, over 100,000 validated dependency builds secured to the SLSA Level 3 standard, and AI-assisted scanning tools integrated into the application lifecycle.

References

• NVD: CVE-2026-40987
• Spring Security Advisory: CVE-2026-40987
• Spring Security Advisories Index
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory
• InboundFileSynchronizer API Documentation (Spring Integration 7.0.4)
• FTP Inbound Channel Adapter Documentation
• SMB Support Documentation
• Broadcom Expands Its Investment in Spring and Java Ecosystem Security
• Broadcom Bolsters Spring Security with Largest Update Ever
• Spring Integration Project Page
• CISA Known Exploited Vulnerabilities Catalog
• Spring Path Traversal Guide: Examples and Prevention (StackHawk)
• spring-projects/security-advisories (GitHub)