cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader . Under these conditions, a view name containing backslash sequences can escape the configured template directory, potentially exposing files that should not be accessible. Returning a view name derived from untrusted input is an application-level anti-pattern that Spring documentation warns against; applications that do not do so are not affect…

Spring Security Advisoriesで読む