PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41863 Spring CVE debrief

Spring AI versions 1.1.0 through 1.1.x contain a path traversal vulnerability in their Anthropic Skills API integration. The application uses LLM-influenced filenames without sanitization when calling Path.resolve() before writing files to disk, allowing authenticated attackers to write files outside the intended target directory. This could enable writing to restricted system directories, potentially leading to configuration tampering or code execution depending on application context. The vulnerability requires network access and low-privileged authentication but has no user interaction requirement. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) indicates medium severity with high impact to integrity. VMware/Spring has published an official security advisory. No known exploitation in ransomware campaigns has been reported.

Vendor
Spring
Product
Spring AI
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-05-26
Advisory published
2026-05-25
Advisory updated
2026-05-26

Who should care

Organizations running Spring AI 1.1.0-1.1.x with Anthropic Skills API integration; development teams building LLM-integrated applications with file system operations; security teams monitoring supply chain risks in AI/ML frameworks

Technical summary

The vulnerability exists in Spring AI's integration with Anthropic's Skills API, where filenames generated or influenced by LLM responses are passed unsanitized to Path.resolve(). This allows path traversal sequences (e.g., ../) to escape the intended target directory. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Attackers with low-privileged network access can achieve high integrity impact by writing arbitrary files to restricted locations. The vulnerability does not affect confidentiality or availability per the CVSS vector.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Spring AI to a version newer than 1.1.x when available, or apply vendor-provided patches
  • Implement strict input validation and sanitization for all LLM-influenced filenames before Path.resolve() operations
  • Use chroot jails or container filesystem restrictions to limit writeable directories
  • Enable application-level path canonicalization and verify resolved paths remain within intended base directories
  • Review file write permissions and apply principle of least privilege to application service accounts
  • Monitor for anomalous file system activity in application directories and parent paths

Evidence notes

Vulnerability confirmed through official Spring security advisory ([email protected]). CWE-22 (Path Traversal) classification from vendor. Affected version range explicitly stated as 1.1.0 through 1.1.x. CVSS 3.1 score 6.5 (MEDIUM) with integrity impact rated HIGH.

Official resources

2026-05-25