CVE-2024-38819

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Affected

Spring Framework

CVSS v3.1 VMWARE

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

56.04% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-22

Published

2024-12-19

Updated

2025-01-10

Proof-of-concept exploits (4)

• GhostS3c/CVE-2024-388193★ · 2024-12-16
• masa42/CVE-2024-38819-POC39★ · 2024-12-14
• skrkcb2/cve-2024-388190★ · 2025-03-11
• vishalnoza/CVE-2024-38819-POC21★ · 2025-06-25

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-38819.yaml

Security advisories

• advisories/GHSA-g5vr-rgqm-vf78

References

• CVE Record
• NVD entry

Related

• CVE-2024-38821
• CVE-2023-46604
• CVE-2024-5452
• CVE-2025-0851
• CVE-2025-0924