CVE-2026-47887

score

0.2

cvss

6.1

epss

0.2%

published

2026-08-27

kev added

—

first seen

2026-10-21

Spring Framework 5.2.25.RELEASE and earlier, 5.3.0 - 5.3.49, 6.0.0 - 6.0.30, 6.1.0 - 6.1.28, 6.2.0 - 6.2.19, and 7.0.0 - 7.0.8 contain an open redirect caused by UrlFileNameViewController mapped with an end-of-path and no configured prefix, letting attackers redirect users to arbitrary URLs, exploit requires specific controller mapping.