CVE-2024-38819

CVE-2024-38819 is a path traversal vulnerability (CWE-22) in the functional web frameworks of Spring Framework (WebMvc.fn and WebFlux.fn) that affects applications serving static resources through those APIs. An unauthenticated remote attacker can send crafted HTTP requests containing traversal sequences to read arbitrary files on the host, limited to files the Java process can access; there is no integrity or availability impact (CVSS 3.1: 7.5 High, C:H/I:N/A:N). Any application built on the affected frameworks and exposing static resources via functional endpoints is exposed, including Spring Boot applications configured this way, although the source data does not specify exact affected version ranges. No public proof of concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, but EPSS puts the 30-day exploitation probability at roughly 55% (99th percentile), so patching urgency is high.

What to do: Upgrade Spring Framework to the patched releases per the vendor advisory (5.3.41 or 6.1.14; for Spring Boot, move to a Boot release bundling the fixed framework). Audit your applications for RouterFunction-based static resource serving via WebMvc.fn/WebFlux.fn, and as an interim mitigation run the application process with least-privilege file system access and/or filter path-traversal patterns (including encoded variants) at a reverse proxy or WAF. No public PoC exists yet, but the elevated EPSS score indicates exploitation is plausible within 30 days, so prioritize patching.