CVE-2026-47884: Spring Framework Improper Path Limitation in XsltView

August 27, 2026 (updated October 5, 2026)

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an “/**” mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

References

github.com/advisories/GHSA-pc63-qcmh-9cmg
github.com/spring-projects/spring-framework/commit/692dbc9160de3b5de50ccedeee014716d0cedb7b
nvd.nist.gov/vuln/detail/CVE-2026-47884
spring.io/security/cve-2026-47884

Code Behaviors & Features

Detect and mitigate CVE-2026-47884 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →