CVE-2026-47884: Spring Framework XsltView RCE Vulnerability

CVE-2026-47884 Overview

CVE-2026-47884 affects the Spring Framework and involves the use of XsltView in Spring MVC applications. The vulnerability enables Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE) when an application maps /** to a view resolver and the view name is not explicitly specified. Under these conditions, attacker-controlled path segments can flow into XSLT view resolution, allowing untrusted input to influence external resource loading and stylesheet processing.

Critical Impact
Attackers can trigger SSRF and achieve remote code execution against vulnerable Spring MVC applications that expose an /** mapping with implicit view names.

Affected Products

Spring Framework 7.0.0 through 7.0.8
Spring Framework 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, and 6.0.0 through 6.0.30
Spring Framework 5.3.0 through 5.3.49, and 5.2.25.RELEASE and earlier

Discovery Timeline

2026-08-27 - CVE-2026-47884 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47884

Vulnerability Analysis

The flaw resides in Spring MVC's handling of XsltView when combined with a catch-all URL mapping. When a controller or handler mapping uses /** and does not explicitly set a view name, Spring derives the view name from the request path (RequestToViewNameTranslator). If a view resolver produces an XsltView, the resolved name is used to locate an XSLT stylesheet resource, and processing that stylesheet can pull in external entities and remote resources.

Because the view name is influenced by the request URI, an attacker who can shape the path controls the stylesheet reference. XSLT processors support functions such as document() that fetch remote content, enabling SSRF against internal services. Combined with extension mechanisms exposed by underlying XSLT engines, this can escalate to remote code execution in the JVM context of the Spring application. The vulnerability class combines Server-Side Request Forgery and Code Injection via server-side template resolution.

Root Cause

The root cause is implicit view-name resolution against untrusted request paths in configurations where XsltView is the resolved view type. Spring does not restrict the derived view name when the mapping is /**, so attacker-controlled path segments reach XSLT resource lookup and processing.

Attack Vector

An unauthenticated remote attacker sends an HTTP request whose path is translated into a view name that resolves to an XsltView. The XSLT engine loads a stylesheet or referenced external resource influenced by the request, triggering outbound requests (SSRF) and, depending on the XSLT processor configuration, code execution. Technical details are documented in the Spring Security Advisory CVE-2026-47884.

Detection Methods for CVE-2026-47884

Indicators of Compromise

Unexpected outbound HTTP or file-scheme requests originating from Spring application JVMs shortly after inbound requests to /**-mapped endpoints.
Application logs showing XsltView resolution or TransformerException entries tied to unusual request paths.
Requests containing URL-encoded characters or path segments that resemble stylesheet references or remote URIs.

Detection Strategies

Inventory Spring MVC applications for use of XsltView or XsltViewResolver with catch-all /** handler mappings and implicit view names.
Instrument web access logs to correlate suspicious URI patterns with subsequent egress traffic from application hosts.
Perform dependency scanning to identify Spring Framework versions within the vulnerable ranges.

Monitoring Recommendations

Alert on Spring application processes initiating connections to internal metadata endpoints or non-standard hosts.
Monitor for XSLT processor errors and view-resolution exceptions in application telemetry.
Track HTTP 5xx spikes on endpoints handled by /** mappings.

How to Mitigate CVE-2026-47884

Immediate Actions Required

Upgrade Spring Framework to a fixed version as listed in the Spring Security Advisory CVE-2026-47884.
Remove or replace XsltView usage in applications that rely on /** mappings without explicit view names.
Set explicit view names on every handler method that returns a view.

Patch Information

Refer to the Spring Security Advisory CVE-2026-47884 for the specific patched versions across the 5.3.x, 6.0.x, 6.1.x, 6.2.x, and 7.0.x release lines. Apply the corresponding maintenance release for the branch in use.

Workarounds

Replace /** mappings with specific path patterns that avoid implicit view-name translation.
Disable XSLT external entity resolution and remote document loading in the underlying TransformerFactory configuration.
Restrict application egress at the network layer to block SSRF-driven outbound requests.

bash

# Configuration example: harden TransformerFactory used behind XsltView
# (apply in application initialization code)
# transformerFactory.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true);
# transformerFactory.setAttribute("http://javax.xml.XMLConstants/property/accessExternalDTD", "");
# transformerFactory.setAttribute("http://javax.xml.XMLConstants/property/accessExternalStylesheet", "");