{"id":"CVE-2026-22737","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-22737","generatedAt":"2026-10-28T02:20:17.968Z","title":"Use of Java scripting engine enabled (e.g.","description":"Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.","published":"2026-03-20T00:16:16.000Z","lastModified":"2026-06-17T10:20:19.000Z","status":"Analyzed","sourceIdentifier":"security@vmware.com","cvss":{"version":"3.1","score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-22"],"affected":["vmware/spring framework"],"epss":{"score":0.004,"percentile":0.33991,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://spring.io/security/cve-2026-22737","tags":["Vendor Advisory"],"source":"security@vmware.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-22737","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}