Advisoriesby IbisVMwareCVE-2026-47894
Spring Cloud Config Server native environment repository
No fix yet
Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path.
Spring Cloud Config 5.0.0 - 5.0.4
Spring Cloud Config 4.3.0 - 4.3.4
Spring Cloud Config 4.0.0 - 4.2.8
Spring Cloud Config 3.1.14 and earlier
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Spring Cloud Config Product | >= 5.0.0, <= 5.0.4 | No fix yet |
| >= 4.3.0, <= 4.3.4 | No fix yet | |
| >= 4.0.0, <= 4.2.8 | No fix yet | |
| <= 3.1.14 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Severity from
- the vendor (its own CVE record or advisory)