CVE-2026-47887

A flaw was found in Spring Framework. A Spring MVC application utilizing UrlFileNameViewController with an end-of-path mapping and no configured prefix is susceptible to an open redirect vulnerability. This could allow an attacker to redirect users to arbitrary malicious websites, potentially leading to phishing attacks or other social engineering exploits.

An open redirect vulnerability exists in Spring Web MVC when UrlFileNameViewController is configured with an end-of-path mapping and lacks a defined prefix. An unauthenticated remote attacker can exploit this by enticing a user to follow a specially crafted URL, leading to an external redirection to an arbitrary domain. Because redirection occurs entirely within the context of browser navigation and application-level routing, default system isolation mechanisms like SELinux or non-root container boundaries do not mitigate the flaw. Technical impact is limited to phishing and user redirection without direct impact to server integrity or confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure explicit prefixes for UrlFileNameViewController mappings, or enforce strict URL validation using an explicit path-prefix or custom view resolver to prevent unauthenticated arbitrary external redirects.