CVE-2026-47862 Overview
CVE-2026-47862 is a path traversal vulnerability in Spring Integration's ZipTransformer component. An attacker who can control the file_name header on a message reaching a ZipTransformer configured with ZipResultType.FILE (the default) can write the resulting .zip archive to an arbitrary filesystem path outside the configured workDirectory. The flaw affects multiple supported Spring Integration release lines. Successful exploitation requires the attacker to influence message headers reaching the transformer, which typically requires some level of authenticated or trusted input into the integration flow.
Critical Impact
Attackers can write attacker-controlled zip archives to arbitrary filesystem locations, potentially overwriting configuration files or dropping payloads into sensitive directories.
Affected Products
- Spring Integration 7.1.0
- Spring Integration 7.0.0 through 7.0.5
- Spring Integration 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12
Discovery Timeline
- 2026-08-27 - CVE-2026-47862 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-47862
Vulnerability Analysis
Spring Integration's ZipTransformer builds zip archives from inbound messages. When the transformer operates with ZipResultType.FILE, it writes archive output to disk using a filename derived from the file_name message header. The transformer does not sanitize path separators or traversal sequences in this header before joining it with the configured workDirectory. As a result, values such as ../../etc/cron.d/payload.zip escape the intended output directory. This is a Path Traversal weakness [CWE-22] affecting file placement rather than file read.
Root Cause
The root cause is missing validation of the file_name header against the resolved absolute path of workDirectory. The transformer trusts the header value as a relative filename and concatenates it with the working directory. Because Java's file APIs resolve .. segments and absolute paths transparently, any traversal sequence or absolute path in the header changes the destination. The workDirectory boundary is therefore advisory rather than enforced.
Attack Vector
Exploitation requires an attacker to influence the file_name header on a message routed to a vulnerable ZipTransformer. In practice, this header is often populated from upstream sources such as HTTP file upload adapters, FTP inbound channel adapters, or MQ payload metadata. An attacker who controls any of these sources can supply a header value containing ../ sequences or an absolute path. The transformer then writes the generated .zip file to that path with the privileges of the running Spring Integration process. See the Spring Security Advisory for CVE-2026-47862 for vendor guidance.
No verified proof-of-concept code is available. The vulnerability mechanism is described in prose per the vendor advisory.
Detection Methods for CVE-2026-47862
Indicators of Compromise
- Unexpected .zip files appearing outside the configured workDirectory on hosts running Spring Integration.
- Application logs showing file_name header values containing ../, backslashes, or absolute path prefixes.
- Modified timestamps on system directories such as /etc, web application roots, or scheduled task directories where the Spring Integration process has write access.
Detection Strategies
- Inspect Spring Integration message traces and audit logs for file_name header values containing path separators or traversal sequences.
- Perform filesystem integrity monitoring on directories adjacent to and above the configured workDirectory to catch out-of-scope writes.
- Review upstream adapters (HTTP, FTP, SFTP, JMS) that populate the file_name header to identify untrusted inputs reaching ZipTransformer.
Monitoring Recommendations
- Enable DEBUG logging on org.springframework.integration.zip during triage to capture header values and resolved output paths.
- Alert on process file writes by the Spring Integration JVM to paths outside its designated working directory.
- Correlate inbound adapter events with resulting file creation events to identify anomalous destination paths.
How to Mitigate CVE-2026-47862
Immediate Actions Required
- Upgrade to a fixed Spring Integration release line as identified in the Spring Security Advisory for CVE-2026-47862.
- Audit all flows that use ZipTransformer with the default ZipResultType.FILE and identify upstream sources of the file_name header.
- Restrict filesystem permissions of the Spring Integration process so it cannot write to sensitive directories such as configuration, startup, or web root paths.
Patch Information
VMware/Spring has published fixed versions for the 6.4.x, 6.5.x, 7.0.x, and 7.1.x release lines. Refer to the Spring Security Advisory for CVE-2026-47862 for exact patched version numbers and upgrade guidance.
Workarounds
- Explicitly overwrite the file_name header with a sanitized value before the message reaches ZipTransformer, using a header enricher or transformer that strips path separators and traversal sequences.
- Switch ZipResultType to BYTE_ARRAY or INPUT_STREAM where feasible, so the transformer does not write to disk.
- Constrain the runtime user account for the Spring Integration process to prevent writes outside the intended workDirectory.
# Configuration example: sanitize file_name before ZipTransformer
# Spring Integration DSL snippet (Java)
#
# .enrichHeaders(h -> h.headerFunction("file_name",
# m -> Paths.get(((String) m.getHeaders().get("file_name")))
# .getFileName().toString()))
# .transform(new ZipTransformer())
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
