diff --git a/advisories/unreviewed/2026/06/GHSA-792x-6vq6-j8r9/GHSA-792x-6vq6-j8r9.json b/advisories/unreviewed/2026/06/GHSA-792x-6vq6-j8r9/GHSA-792x-6vq6-j8r9.json index 6c074e8df1d3e..ed84249e8200a 100644 --- a/advisories/unreviewed/2026/06/GHSA-792x-6vq6-j8r9/GHSA-792x-6vq6-j8r9.json +++ b/advisories/unreviewed/2026/06/GHSA-792x-6vq6-j8r9/GHSA-792x-6vq6-j8r9.json @@ -1,19 +1,116 @@ { "schema_version": "1.4.0", "id": "GHSA-792x-6vq6-j8r9", - "modified": "2026-06-11T09:31:55Z", + "modified": "2026-06-11T09:32:01Z", "published": "2026-06-11T09:31:55Z", "aliases": [ "CVE-2026-40987" ], - "details": "A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.\n\nAffected versions:\nSpring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.", + "summary": "spring-integration-file gives remote attacker full write access to file system", + "details": "A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework.integration:spring-integration-file" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.0.4.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework.integration:spring-integration-file" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.5.0" + }, + { + "fixed": "6.5.8.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework.integration:spring-integration-file" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.4.0" + }, + { + "fixed": "6.4.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework.integration:spring-integration-file" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.3.0" + }, + { + "fixed": "6.3.15" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.springframework.integration:spring-integration-file" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "5.5.0" + }, + { + "fixed": "5.5.21" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY",