Answer in brief
CVE-2025-41242 records a Medium severity (CVSS 5.9) vulnerability in Spring Framework MVC Applications Path Traversal Vulnerability. The current sources do not mark it as known exploited. The current feed maps org.springframework:spring-webmvc (maven), org.springframework:spring-webmvc (maven), org.springframework:spring-webmvc (maven), org.springframework:spring-webmvc (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps org.springframework:spring-webmvc (maven), org.springframework:spring-webmvc (maven), org.springframework:spring-webmvc (maven), org.springframework:spring-webmvc (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| org.springframework:spring-webmvcmaven | >=6.2.0 <6.2.10 | 6.2.10 |
| org.springframework:spring-webmvcmaven | >=6.1.0 | Not reported |
| org.springframework:spring-webmvcmaven | >=6.0.0 | Not reported |
| org.springframework:spring-webmvcmaven | >=5.3.0 | Not reported |
Published upstream
Aug 18, 2025
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.
Quoted source text, attributed separately from HOL analysis.