Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux
    applications can result in disclosure of content from files outside the configured locations for script
    template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16,
    from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46. (CVE-2026-22737)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux     applications can result in disclosure of content from files outside the configured locations for script     template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16,     from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46. (CVE-2026-22737)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
457625	Echo: org.springframework:spring-webflux: security update to 6.2.17	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457625	Echo: org.springframework:spring-webflux: security update to 6.2.17	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
303353	Linux Distros Unpatched Vulnerability : CVE-2026-22737	Nessus	Misc.	Local	medium
439101	SCA: security update for org.springframework:spring-webflux, org.springframework:spring-webmvc (GHSA-4773-3jfm-qmx3)	Tenable Cloud Security	SCA Checks	Local	medium
439101	SCA: security update for org.springframework:spring-webflux, org.springframework:spring-webmvc (GHSA-4773-3jfm-qmx3)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-22737

medium

Tenable Plugins

medium

medium

medium

medium

medium