CVE-2026-22737

A flaw was found in Spring Framework. When Java scripting engine enabled template views (such as those using JRuby or Jython) are used in Spring MVC and Spring WebFlux applications, a remote attacker can exploit this to disclose sensitive content from files located outside the intended script template view directories. This information disclosure can expose confidential data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid using Java scripting engine enabled template views (e.g., JRuby, Jython) in Spring MVC and Spring WebFlux applications. If these engines are not essential for application functionality, disable or remove their integration to prevent unauthorized file disclosure. Review application configurations to ensure that template view directories are strictly controlled and that no external scripting engines are inadvertently enabled.