A critical path traversal vulnerability in Spring Cloud Config Server enables unauthenticated remote attackers to access unauthorized files on the underlying host filesystem.

The vulnerability exists in the profile parameter substitution logic when the Config Server is configured with a native file system backend. An unauthenticated attacker can craft malicious requests to escape the intended directory boundaries and read sensitive configuration or system files.

The ability for an unauthenticated user to read arbitrary files on the server hosting Spring Cloud Config represents a high-severity risk to data confidentiality. Attackers could potentially extract sensitive credentials, environment variables, or proprietary source code, which may lead to full system compromise or lateral movement within the network. With a CVSS score of 8.6, this flaw is considered highly dangerous due to its ease of exploitation and the potential for significant information disclosure.

Immediate Action: Upgrade to the patched versions of Spring Cloud (3.1.13, 4.1.9, 4.2.3, 4.3.2, or 5.0.2) as specified in the official VMware security advisory.

Proactive Monitoring: Review application and server access logs for requests containing directory traversal sequences, such as double dots (..), directed toward the Config Server endpoints.

Compensating Controls: If immediate patching is not feasible, restrict network access to the Config Server to trusted internal segments and deploy a Web Application Firewall (WAF) rule to block requests containing path traversal patterns.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for unauthenticated file access, organizations should prioritize patching their Spring Cloud implementations immediately. Confirm your current version against the affected list and schedule an emergency maintenance window to apply the vendor-provided updates to prevent potential data exfiltration and unauthorized system access.