CVE-2026-40987: Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

Synopsis

A path traversal vulnerability in Spring Integration's remote-file synchronizer (FTP, SFTP, and SMB adapters) allows a malicious or compromised remote server to write files to arbitrary locations on the client filesystem outside the configured local directory. The vulnerability is reached over the network, requires a low-privilege account, and also requires a victim to initiate or trigger a sync operation, as derived from the CVSS vector (AV:N/PR:L/UI:R). Successful exploitation gives an attacker the ability to write attacker-controlled content to arbitrary filesystem paths, with limited confidentiality and availability impact as well. Patched-image rebuilds at versions 5.5.21, 6.3.15, 6.4.12, 6.5.9, and 7.0.5 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must operate or compromise a remote file server (FTP, SFTP, or SMB) that the client application reaches over the network.

• AuthenticationRequired

  The attacker must hold at least a low-privilege account or position sufficient to control or impersonate the remote file server the client synchronizes against.

• Victim interactionRequired

  A user or scheduled process must trigger a sync operation against the malicious server, making this a social-engineering or configuration-abuse vector rather than a fully autonomous one.

• Attack complexityDetail

  Attack complexity is rated HIGH, meaning the attacker must set up or compromise the specific remote server endpoint the client trusts, rather than exploiting a purely opportunistic path.

Blast Radius

• Writes attacker-controlled file content to arbitrary paths on the client filesystem, including outside the configured local synchronization directory.
• Overwrites sensitive files such as application configuration, credentials, or startup scripts, enabling persistence or privilege escalation on the host.
• Reads limited data accessible through the sync channel, providing partial disclosure of synchronized file metadata or content.
• Disrupts application operation by corrupting or replacing files the application depends on at runtime.