CVE-2026-22737

score

<0.1

cvss

5.9

epss

0.4%

published

2026-03-20

kev added

—

first seen

2026-10-21

Spring Framework 5.3.0 through 5.3.46, 6.1.0 through 6.1.25, 6.2.0 through 6.2.16, and 7.0.0 through 7.0.5 contains an information disclosure caused by use of Java scripting engine enabled template views, letting attackers disclose content from files outside configured script template locations, exploit requires use of vulnerable template views.