HIGHCVSS 7.1EPSS 0.2%

CVE-2026-40987

CVE-2026-40987 updated by NVD

Published: 2026-06-11
Modified: 2026-07-25
EPSS percentile: 11%
Sources: github-advisory, nvd

Summary

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	org.springframework.integration:spring-integration-file	—	7.0.5

Remediation: Upgrade to 7.0.5 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-40987

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.