daehyuh/cve-2026-40987CVE-2026-40987 PoC
This repository is a minimal reproduction PoC for CVE-2026-40987, as disclosed in the official Spring Security Advisory.
Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalizationAV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:LThe remote-file synchronizer in Spring Integration could use the filename provided by the remote server as-is when creating the local storage path. If canonical path validation is insufficient, a malicious or compromised FTP/SFTP/SMB server could return a filename like ../escaped-by-ftp-list.txt, causing files to be written outside the configured localDirectory.
According to the official advisory, this issue is not limited to FTP but applies to the FTP/SFTP/SMB remote file synchronization family in Spring Integration. This PoC uses FtpInboundFileSynchronizer to reproduce the same vulnerable path in the smallest and clearest way.
Affected products per the official advisory:
Affected versions:
7.0.0 - 7.0.46.5.0 - 6.5.86.4.0 - 6.4.116.3.0 - 6.3.145.5.0 - 5.5.20Fixed versions:
7.0.5 or 7.0.4.16.5.9 or 6.5.8.16.4.126.3.155.5.21The tests demonstrate two paths.
SpringIntegrationRemoteFilePathTraversalTest
../escaped-by-spring-integration.txt, the file path is created outside the configured local directory.SpringIntegrationFtpPathTraversalTest
../escaped-by-ftp-list.txt into the FTP server's LIST response.FtpInboundFileSynchronizer receives this filename, downloads incoming/../escaped-by-ftp-list.txt, and the resulting file is created outside the downloads directory.The core flow of the PoC is as follows.
configured localDirectory = <temp>/downloads
remote LIST filename = ../escaped-by-ftp-list.txt
resulting local path = <temp>/downloads/../escaped-by-ftp-list.txt
normalized location = <temp>/escaped-by-ftp-list.txt
In other words, it is possible to write files outside the application's intended download directory.
Windows:
.\mvnw.cmd test
macOS/Linux:
./mvnw test
Expected results for vulnerable versions:
Tests run: 3, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
Test success means "the vulnerable behavior has been reproduced." In other words, with vulnerable dependencies, the tests pass and demonstrate directory traversal writes.
You can verify multiple vulnerable versions with the following commands.
.\mvnw.cmd "-Dspring-integration.version=6.4.10" test
.\mvnw.cmd "-Dspring-integration.version=6.5.8" test
.\mvnw.cmd "-Dspring-integration.version=7.0.4" test
.\mvnw.cmd "-Dspring-integration.version=7.1.0-RC1" test
The default value in this repository is spring-integration.version=7.0.4.
This vulnerability allows an attacker to write attacker-controlled content to the local filesystem of the client application. The attacker must be able to manipulate the response of a remote file server that the application trusts and polls, rather than being a typical HTTP client.
Therefore, while preconditions exist, the following impacts are possible under the right conditions.
The official advisory assessed this issue as High.
The official Spring advisory credits the following researchers for responsible disclosure.