CVE-2026-40987: Spring Integration Path Traversal Flaw

CVE-2026-40987 Overview

CVE-2026-40987 is a path traversal vulnerability [CWE-22] in Spring Integration's FTP, SFTP, and SMB client components. A malicious or compromised remote server can return crafted file names that cause the Spring Integration client to write files outside the configured local directory. The attacker controls both the destination path and the file contents, enabling arbitrary file write across the client filesystem. The flaw affects multiple supported branches of Spring Integration and is documented in the Spring Security Advisory.

Critical Impact
An attacker-controlled file server can write arbitrary content to arbitrary locations on the Spring Integration client host, leading to code execution, configuration tampering, or persistence on the affected system.

Affected Products

Spring Integration 7.0.0 through 7.0.4
Spring Integration 6.5.0 through 6.5.8, 6.4.0 through 6.4.11, and 6.3.0 through 6.3.14
Spring Integration 5.5.0 through 5.5.20

Discovery Timeline

2026-06-11 - CVE-2026-40987 published to NVD
2026-06-11 - Last updated in NVD database

Technical Details for CVE-2026-40987

Vulnerability Analysis

Spring Integration provides inbound adapters that synchronize remote files from FTP, SFTP, and SMB servers to a local directory. The client trusts file names supplied by the remote server when constructing the local destination path. When a server returns a name containing directory traversal sequences such as ../ or an absolute path, the client resolves the destination outside the configured local directory.

Because both the path and the file contents originate from the remote server, an attacker who controls or compromises the server can write arbitrary bytes to any filesystem location writable by the Spring Integration process. Likely abuse scenarios include overwriting application configuration, planting JAR files on the classpath, modifying startup scripts, or dropping web shells into served directories.

Root Cause

The root cause is missing path canonicalization and validation of server-supplied file names before they are joined with the local working directory. The client treats the remote name as a safe relative component instead of normalizing the result and verifying it remains inside the intended base directory.

Attack Vector

Exploitation requires a victim Spring Integration application configured to poll a remote FTP, SFTP, or SMB endpoint controlled or compromised by the attacker. The attacker hosts files with traversal sequences in their names. When the inbound adapter retrieves the listing and downloads the files, the client writes them to attacker-chosen paths. The attack is network-based, requires user or application interaction with the malicious server, and has high attack complexity because the target must be configured to connect to the hostile endpoint. Technical specifics are described in the Spring Security Advisory.

Detection Methods for CVE-2026-40987

Indicators of Compromise

Files written outside the configured local-directory of an FTP, SFTP, or SMB inbound adapter, particularly under paths such as /etc, /root, application configuration directories, or Java classpath locations.
Spring Integration log entries showing remote file names containing .., /, or \ sequences.
Unexpected modification timestamps on system binaries, startup scripts, or deployed application artifacts on hosts running Spring Integration.

Detection Strategies

Inspect Spring Integration logs for FtpInboundFileSynchronizer, SftpInboundFileSynchronizer, and SmbInboundFileSynchronizer activity referencing file names with traversal characters.
Enable filesystem auditing (auditd, Windows object access auditing) on directories outside the configured local sync path and alert on writes by the JVM process running Spring Integration.
Compare the set of files actually written by inbound adapters against the configured local-directory to identify drift.

Monitoring Recommendations

Forward Spring Integration application logs and host filesystem audit events to a centralized SIEM for correlation.
Track outbound connections from Spring Integration hosts to FTP, SFTP, and SMB endpoints, and review changes to remote server allowlists.
Alert on new or unexpected files appearing in classpath, webroot, or autoload directories on hosts running affected versions.

How to Mitigate CVE-2026-40987

Immediate Actions Required

Inventory all applications using Spring Integration FTP, SFTP, or SMB inbound adapters and identify those running affected versions.
Upgrade Spring Integration to a fixed release on the relevant branch as listed in the Spring Security Advisory.
Restrict the Spring Integration process to a least-privilege OS account that cannot write to sensitive system or application directories.
Validate that remote FTP, SFTP, and SMB servers used by inbound adapters are trusted and have not been tampered with.

Patch Information

Pivotal/Spring has published fixed versions for each affected branch. Consult the Spring Security Advisory for the exact patched releases of the 5.5.x, 6.3.x, 6.4.x, 6.5.x, and 7.0.x lines, and update build dependencies (Maven or Gradle) accordingly.

Workarounds

Where patching is not immediately possible, disable FTP, SFTP, and SMB inbound adapters or point them only at fully trusted servers under your control.
Run the Spring Integration JVM inside a container or chroot whose filesystem view is limited to the intended local-directory.
Apply mandatory access controls (SELinux, AppArmor) to confine writes by the JVM process to the configured sync directory.

bash

# Configuration example: pin Spring Integration to a patched version
# Maven (pom.xml)
# <dependency>
#   <groupId>org.springframework.integration</groupId>
#   <artifactId>spring-integration-sftp</artifactId>
#   <version>REPLACE_WITH_PATCHED_VERSION</version>
# </dependency>

# Verify resolved versions
mvn dependency:tree | grep spring-integration