References https://spring.io/security/cve-2024-38816 https://spring.io/security/cve-2024-38819 https://www.herodevs.com/blog-posts/cve-2024-38816-path-traversal-vulnerability-discovered-in-spring-framework https://www.herodevs.com/blog-posts/cve-2024-38819-high-severity-path-traversal-vulnerability-in-spring-framework https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/Spring/Spring-Framework%E8%B7%AF%E5%BE%84%E9%81%8D%E5%8E%86%E6%BC%8F%E6%B4%9E(CVE-2024-38816).md https://zhuanlan.zhihu.com/p/5483655619 https://blog.csdn.net/enthan809882/article/details/147120268 https://avd.aliyun.com/detail?id=AVD-2024-38816 https://nvd.nist.gov/vuln/detail/CVE-2025-41242 https://www.tenable.com/plugins/nessus/207387 https://access.redhat.com/security/cve/cve-2024-38819 https://tuxcare.com/resources/learning/cve-2024-38819/ https://cloud.tencent.com/developer/article/2549737 https://knowledge.broadcom.com/external/article/410487/spring-framework-path-traversal-vulnerab.html
Related VulnerabilitiesPoCCVE-2026-39352: Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path TraversalPoCfrappe-default-login: Frappe Framework - Default Login CredentialsSpringBlade /api/blade-log/api/list SQL 注入漏洞SpringBlade /api/blade-user/list SQL 注入漏洞Spring Actuator 未授权访问漏洞PoCspringboot-sbom: Spring Boot Actuator SBOM - ExposurePoCCVE-2025-41242: Spring Framework - Path TraversalPoCspringboot-httpexchanges: Detects Springboot HTTP Exchanges ActuatorPoCCVE-2024-38819: Spring Framework Path Traversal in Functional Web FrameworksPentaho /pentaho/j_spring_security_check 默认口令漏洞PoCCVE-2026-22739: Spring Cloud Config Server - Path TraversalPoCspringboot-x-application-context: Spring Boot `X-Application-Context` Header ExposureServerless Framework 未授权 命令注入漏洞