Vulnerability-Lookup

CVE-2026-41863 (GCVE-0-2026-41863)

Vulnerability from cvelistv5 – Published: 2026-05-25 05:45 – Updated: 2026-05-26 14:19

Title

LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API

Summary

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories. Affected versions: Spring AI: 1.1.0 through 1.1.x

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

vmware

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-41863

Impacted products

1 product

Vendor	Product	Version
Spring	Spring AI	Affected: 1.1.0 , ≤ 1.1.x (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41863",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-26T14:19:04.863084Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-26T14:19:10.481Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring AI",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "1.1.x",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSpring AI\u0027s support for Anthropic\u0027s Skills API used LLM-influenced filenames unsanitized in \u003ccode\u003ePath.resolve\u003c/code\u003e before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.\u003c/p\u003e\u003cp\u003eAffected versions:\u003cbr\u003eSpring AI: 1.1.0 through 1.1.x\u003c/p\u003e"
            }
          ],
          "value": "Spring AI\u0027s support for Anthropic\u0027s Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.\n\nAffected versions:\nSpring AI: 1.1.0 through 1.1.x"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A malicious user may write files outside the intended target directory, including restricted directories."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-25T05:45:37.690Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41863"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41863",
    "datePublished": "2026-05-25T05:45:37.690Z",
    "dateReserved": "2026-04-22T06:22:10.082Z",
    "dateUpdated": "2026-05-26T14:19:10.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-41863",
      "date": "2026-07-26",
      "epss": "0.00398",
      "percentile": "0.32451"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-41863\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2026-05-25T07:16:16.377\",\"lastModified\":\"2026-07-23T17:10:00.123\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Spring AI\u0027s support for Anthropic\u0027s Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.\\n\\nAffected versions:\\nSpring AI: 1.1.0 through 1.1.x\"},{\"lang\":\"es\",\"value\":\"El soporte de Spring AI para la API de Habilidades de Anthropic utilizaba nombres de archivo influenciados por LLM sin sanear en Path.resolve antes de escribir archivos en el disco. Esto podr\u00eda permitir a un usuario malintencionado escribir archivos fuera del directorio de destino previsto, incluyendo directorios restringidos.\\n\\nVersiones afectadas:\\nSpring AI: 1.1.0 hasta 1.1.x\"}],\"affected\":[{\"source\":\"security@vmware.com\",\"affectedData\":[{\"vendor\":\"Spring\",\"product\":\"Spring AI\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"1.1.0\",\"lessThanOrEqual\":\"1.1.x\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-26T14:19:04.863084Z\",\"id\":\"CVE-2026-41863\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.1.0\",\"versionEndExcluding\":\"1.1.7\",\"matchCriteriaId\":\"79B32FFF-1F8A-4904-BFC7-C41C07FFC575\"}]}]}],\"references\":[{\"url\":\"https://spring.io/security/cve-2026-41863\",\"source\":\"security@vmware.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:35:57+00:00",
      "cve": "CVE-2026-41863",
      "id": "CVE-2026-41863",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41863.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-41863\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-26T14:19:04.863084Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-26T14:19:07.760Z\"}}], \"cna\": {\"title\": \"LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills API\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"A malicious user may write files outside the intended target directory, including restricted directories.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Spring\", \"product\": \"Spring AI\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.1.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.1.x\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://spring.io/security/cve-2026-41863\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Spring AI\u0027s support for Anthropic\u0027s Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.\\n\\nAffected versions:\\nSpring AI: 1.1.0 through 1.1.x\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eSpring AI\u0027s support for Anthropic\u0027s Skills API used LLM-influenced filenames unsanitized in \u003ccode\u003ePath.resolve\u003c/code\u003e before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.\u003c/p\u003e\u003cp\u003eAffected versions:\u003cbr\u003eSpring AI: 1.1.0 through 1.1.x\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"shortName\": \"vmware\", \"dateUpdated\": \"2026-05-25T05:45:37.690Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-41863\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-26T14:19:10.481Z\", \"dateReserved\": \"2026-04-22T06:22:10.082Z\", \"assignerOrgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"datePublished\": \"2026-05-25T05:45:37.690Z\", \"assignerShortName\": \"vmware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0646

Vulnerability from certfr_avis - Published: 2026-05-26 - Updated: 2026-05-26

Une vulnérabilité a été découverte dans Spring AI. Elle permet à un attaquant de provoquer une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Spring	Spring AI	Spring AI versions 1.1.x antérieures à 1.1.7

References

Title

Publication Time

FKIE_CVE-2026-41863

Vulnerability from fkie_nvd - Published: 2026-05-25 07:16 - Updated: 2026-06-17 10:47

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security@vmware.com	https://spring.io/security/cve-2026-41863	Vendor Advisory

Impacted products

	Vendor	Product	Version
	vmware	spring_ai	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring AI",
          "vendor": "Spring",
          "versions": [
            {
              "lessThanOrEqual": "1.1.x",
              "status": "affected",
              "version": "1.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@vmware.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "79B32FFF-1F8A-4904-BFC7-C41C07FFC575",
              "versionEndExcluding": "1.1.7",
              "versionStartIncluding": "1.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Spring AI\u0027s support for Anthropic\u0027s Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.\n\nAffected versions:\nSpring AI: 1.1.0 through 1.1.x"
    }
  ],
  "id": "CVE-2026-41863",
  "lastModified": "2026-06-17T10:47:07.923",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security@vmware.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41863",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-26T14:19:04.863084Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-25T07:16:16.377",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://spring.io/security/cve-2026-41863"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security@vmware.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CC4M-MP48-X7QG

Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-06-30 16:50

Summary

Spring AI's support for Anthropic's Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk

Details

Affected versions: Spring AI: 1.1.0 through 1.1.7

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.ai:spring-ai-anthropic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.1.0"
            },
            {
              "fixed": "1.1.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41863"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-30T16:50:37Z",
    "nvd_published_at": "2026-05-25T07:16:16Z",
    "severity": "MODERATE"
  },
  "details": "Spring AI\u0027s support for Anthropic\u0027s Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.\n\nAffected versions:\nSpring AI: 1.1.0 through 1.1.7",
  "id": "GHSA-cc4m-mp48-x7qg",
  "modified": "2026-06-30T16:50:37Z",
  "published": "2026-05-26T13:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41863"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spring-projects/spring-ai"
    },
    {
      "type": "WEB",
      "url": "https://spring.io/security/cve-2026-41863"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spring AI\u0027s support for Anthropic\u0027s Skills API used LLM-influenced filenames unsanitized in Path.resolve before writing files to disk"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-41863 (GCVE-0-2026-41863)

CERTFR-2026-AVI-0646

Solutions

FKIE_CVE-2026-41863

GHSA-CC4M-MP48-X7QG

Tags

Sightings

Nomenclature