CVE-2026-40987

Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

7.1 HighPublic exploitFix available

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.

Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: High
Availability: Low

Exploit likelihood

0.22%Up 0.2 points since Jun 11, 2026

What each source reports

CVE List Score used 7.1

Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.

Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

Record: CVE-2026-40987
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2026-36202 7.1

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.

Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

Record: EUVD-2026-36202
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-792x-6vq6-j8r9 7.1

Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.

Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

Record: GHSA-792x-6vq6-j8r9
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weakness: CWE-22
Updated: 2026-11-02

NVD 7.1

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.

Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

Record: CVE-2026-40987
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weakness: CWE-22
Updated: 2026-11-02

OSV 7.1

Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.

Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

Record: CVE-2026-40987
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weakness: CWE-22
Updated: 2026-11-02

OSVGHSA-792x-6vq6-j8r9 7.1

Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content.

Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

Record: GHSA-792x-6vq6-j8r9
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
Weakness: CWE-22
Updated: 2026-11-02

Show 15 moreShow less

OSVCLSA-2026-1785380362 No score

TuxCare security update for org.springframework.integration (1 CVE)

TuxCare rebuilt 2 org.springframework.integration packages to address 1 CVE. Fixed in 6.4.10-tuxcare.1.

Record: CLSA-2026-1785380362
Updated: 2026-11-02

OSVCLSA-2026-1788470094 No score

TuxCare security update for org.springframework.integration (1 CVE)

TuxCare rebuilt 2 org.springframework.integration packages to address 1 CVE. Fixed in 6.3.11-tuxcare.1.

Record: CLSA-2026-1788470094
Updated: 2026-11-02

OSVCLSA-2026-1788820092 No score

TuxCare security update for org.springframework.integration (5 CVEs)

TuxCare rebuilt 5 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.20-tuxcare.6.

Record: CLSA-2026-1788820092
Updated: 2026-11-02

OSVCLSA-2026-1790050729 No score

TuxCare security update for org.springframework.integration (5 CVEs)

TuxCare rebuilt 5 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.19-tuxcare.1.

Record: CLSA-2026-1790050729
Updated: 2026-11-02

OSVCLSA-2026-1790875447 No score

TuxCare security update for org.springframework.integration (5 CVEs)

TuxCare rebuilt 5 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.16-tuxcare.1.

Record: CLSA-2026-1790875447
Updated: 2026-11-02

OSVCLSA-2026-1791398579 No score

TuxCare security update for org.springframework.integration (11 CVEs)

TuxCare rebuilt 11 org.springframework.integration packages to address 11 CVEs. Fixed in 6.4.9-tuxcare.2.

Record: CLSA-2026-1791398579
Updated: 2026-11-02

OSVCLSA-2026-1791488248 No score

TuxCare security update for org.springframework.integration (1 CVE)

TuxCare rebuilt 2 org.springframework.integration packages to address 1 CVE. Fixed in 6.2.11-tuxcare.1.

Record: CLSA-2026-1791488248
Updated: 2026-11-02

OSVCLSA-2026-1791971283 No score

TuxCare security update for org.springframework.integration (14 CVEs)

TuxCare rebuilt 10 org.springframework.integration packages to address 14 CVEs. Fixed in 6.3.10-tuxcare.2.

Record: CLSA-2026-1791971283
Updated: 2026-11-02

OSVCLSA-2026-1791997763 No score

TuxCare security update for org.springframework.integration (5 CVEs)

TuxCare rebuilt 5 org.springframework.integration packages to address 5 CVEs. Fixed in 5.3.2.RELEASE-tuxcare.1.

Record: CLSA-2026-1791997763
Updated: 2026-11-02

OSVCLSA-2026-1792000753 No score

TuxCare security update for org.springframework.integration (14 CVEs)

TuxCare rebuilt 10 org.springframework.integration packages to address 14 CVEs. Fixed in 6.2.5-tuxcare.1.

Record: CLSA-2026-1792000753
Updated: 2026-11-02

OSVCLSA-2026-1792000791 No score

TuxCare security update for org.springframework.integration (14 CVEs)

TuxCare rebuilt 10 org.springframework.integration packages to address 14 CVEs. Fixed in 6.1.5-tuxcare.1.

Record: CLSA-2026-1792000791
Updated: 2026-11-02

OSVCLSA-2026-1792508128 No score

TuxCare security update for org.springframework.integration (10 CVEs)

TuxCare rebuilt 8 org.springframework.integration packages to address 10 CVEs. Fixed in 5.1.13.RELEASE-tuxcare.1.

Record: CLSA-2026-1792508128
Updated: 2026-11-02

OSVCLSA-2026-1792518003 No score

TuxCare security update for org.springframework.integration (10 CVEs)

TuxCare rebuilt 8 org.springframework.integration packages to address 10 CVEs. Fixed in 5.5.12-tuxcare.1.

Record: CLSA-2026-1792518003
Updated: 2026-11-02

OSVCLSA-2026-1792518040 No score

TuxCare security update for org.springframework.integration (10 CVEs)

TuxCare rebuilt 8 org.springframework.integration packages to address 10 CVEs. Fixed in 5.4.6-tuxcare.1.

Record: CLSA-2026-1792518040
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2026-40987 No score

CVE-2026-40987 in org.springframework.integration:spring-integration-file - Patched by Root

Root has patched CVE-2026-40987 in the org.springframework.integration:spring-integration-file package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2026-40987
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework.integration:spring-integration-file` Maven	6.4.0 to 6.4.11	None known
`org.springframework.integration:spring-integration-file` Maven	6.3.0 to 6.3.14	None known
`org.springframework.integration:spring-integration-file` Maven	through 5.5.20	None known
`org.springframework.integration:spring-integration-file` Maven	7.0.0 to 7.0.4	7.0.5
`org.springframework.integration:spring-integration-file` Maven	6.5.0 to 6.5.8	6.5.9
`org.springframework.integration:spring-integration-file` TuxCare:Maven	6.4.10 up to 6.4.10-tuxcare.1	6.4.10-tuxcare.1
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven	6.4.10 up to 6.4.10-tuxcare.1	6.4.10-tuxcare.1
`org.springframework.integration:spring-integration-file` TuxCare:Maven	6.3.11 up to 6.3.11-tuxcare.1	6.3.11-tuxcare.1
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven	6.3.11 up to 6.3.11-tuxcare.1	6.3.11-tuxcare.1
`org.springframework.integration:spring-integration-core` TuxCare:Maven From an advisory covering 5 CVEs	5.5.20 up to 5.5.20-tuxcare.6, plus listed versions 5.5.20-tuxcare.25.5.20-tuxcare.35.5.20-tuxcare.45.5.20-tuxcare.55.5.20.tuxcare.1	5.5.20-tuxcare.6

Show 93 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework.integration:spring-integration-file` TuxCare:Maven From an advisory covering 5 CVEs	5.5.20 up to 5.5.20-tuxcare.6, plus listed versions 5.5.20-tuxcare.25.5.20-tuxcare.35.5.20-tuxcare.45.5.20-tuxcare.55.5.20.tuxcare.1	5.5.20-tuxcare.6
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven From an advisory covering 5 CVEs	5.5.20 up to 5.5.20-tuxcare.6, plus listed versions 5.5.20-tuxcare.25.5.20-tuxcare.35.5.20-tuxcare.45.5.20-tuxcare.55.5.20.tuxcare.1	5.5.20-tuxcare.6
`org.springframework.integration:spring-integration-http` TuxCare:Maven From an advisory covering 5 CVEs	5.5.20 up to 5.5.20-tuxcare.6, plus listed versions 5.5.20-tuxcare.25.5.20-tuxcare.35.5.20-tuxcare.45.5.20-tuxcare.55.5.20.tuxcare.1	5.5.20-tuxcare.6
`org.springframework.integration:spring-integration-jms` TuxCare:Maven From an advisory covering 5 CVEs	5.5.20 up to 5.5.20-tuxcare.6, plus listed versions 5.5.20-tuxcare.25.5.20-tuxcare.35.5.20-tuxcare.45.5.20-tuxcare.55.5.20.tuxcare.1	5.5.20-tuxcare.6
`org.springframework.integration:spring-integration-core` TuxCare:Maven From an advisory covering 5 CVEs	5.5.19 up to 5.5.19-tuxcare.1	5.5.19-tuxcare.1
`org.springframework.integration:spring-integration-file` TuxCare:Maven From an advisory covering 5 CVEs	5.5.19 up to 5.5.19-tuxcare.1	5.5.19-tuxcare.1
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven From an advisory covering 5 CVEs	5.5.19 up to 5.5.19-tuxcare.1	5.5.19-tuxcare.1
`org.springframework.integration:spring-integration-http` TuxCare:Maven From an advisory covering 5 CVEs	5.5.19 up to 5.5.19-tuxcare.1	5.5.19-tuxcare.1
`org.springframework.integration:spring-integration-jms` TuxCare:Maven From an advisory covering 5 CVEs	5.5.19 up to 5.5.19-tuxcare.1	5.5.19-tuxcare.1
`org.springframework.integration:spring-integration-core` TuxCare:Maven From an advisory covering 5 CVEs	5.5.16 up to 5.5.16-tuxcare.1	5.5.16-tuxcare.1
`org.springframework.integration:spring-integration-file` TuxCare:Maven From an advisory covering 5 CVEs	5.5.16 up to 5.5.16-tuxcare.1	5.5.16-tuxcare.1
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven From an advisory covering 5 CVEs	5.5.16 up to 5.5.16-tuxcare.1	5.5.16-tuxcare.1
`org.springframework.integration:spring-integration-http` TuxCare:Maven From an advisory covering 5 CVEs	5.5.16 up to 5.5.16-tuxcare.1	5.5.16-tuxcare.1
`org.springframework.integration:spring-integration-jms` TuxCare:Maven From an advisory covering 5 CVEs	5.5.16 up to 5.5.16-tuxcare.1	5.5.16-tuxcare.1
`org.springframework.integration:spring-integration-core` TuxCare:Maven From an advisory covering 11 CVEs	6.4.9 up to 6.4.9-tuxcare.2, plus listed versions 6.4.9-tuxcare.1	6.4.9-tuxcare.2
`org.springframework.integration:spring-integration-file` TuxCare:Maven From an advisory covering 11 CVEs	6.4.9 up to 6.4.9-tuxcare.2, plus listed versions 6.4.9-tuxcare.1	6.4.9-tuxcare.2
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven From an advisory covering 11 CVEs	6.4.9 up to 6.4.9-tuxcare.2, plus listed versions 6.4.9-tuxcare.1	6.4.9-tuxcare.2
`org.springframework.integration:spring-integration-http` TuxCare:Maven From an advisory covering 11 CVEs	6.4.9 up to 6.4.9-tuxcare.2, plus listed versions 6.4.9-tuxcare.1	6.4.9-tuxcare.2
`org.springframework.integration:spring-integration-ip` TuxCare:Maven From an advisory covering 11 CVEs	6.4.9 up to 6.4.9-tuxcare.2, plus listed versions 6.4.9-tuxcare.1	6.4.9-tuxcare.2
`org.springframework.integration:spring-integration-jdbc` TuxCare:Maven From an advisory covering 11 CVEs	6.4.9 up to 6.4.9-tuxcare.2, plus listed versions 6.4.9-tuxcare.1	6.4.9-tuxcare.2
`org.springframework.integration:spring-integration-jms` TuxCare:Maven From an advisory covering 11 CVEs	6.4.9 up to 6.4.9-tuxcare.2, plus listed versions 6.4.9-tuxcare.1	6.4.9-tuxcare.2
`org.springframework.integration:spring-integration-scripting` TuxCare:Maven From an advisory covering 11 CVEs	6.4.9 up to 6.4.9-tuxcare.2, plus listed versions 6.4.9-tuxcare.1	6.4.9-tuxcare.2
`org.springframework.integration:spring-integration-smb` TuxCare:Maven From an advisory covering 11 CVEs	6.4.9 up to 6.4.9-tuxcare.2, plus listed versions 6.4.9-tuxcare.1	6.4.9-tuxcare.2
`org.springframework.integration:spring-integration-syslog` TuxCare:Maven From an advisory covering 11 CVEs	6.4.9 up to 6.4.9-tuxcare.2, plus listed versions 6.4.9-tuxcare.1	6.4.9-tuxcare.2
`org.springframework.integration:spring-integration-zip` TuxCare:Maven From an advisory covering 11 CVEs	6.4.9 up to 6.4.9-tuxcare.2, plus listed versions 6.4.9-tuxcare.1	6.4.9-tuxcare.2
`org.springframework.integration:spring-integration-file` TuxCare:Maven	6.2.11 up to 6.2.11-tuxcare.1	6.2.11-tuxcare.1
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven	6.2.11 up to 6.2.11-tuxcare.1	6.2.11-tuxcare.1
`org.springframework.integration:spring-integration-core` TuxCare:Maven From an advisory covering 14 CVEs	6.3.10 up to 6.3.10-tuxcare.2, plus listed versions 6.3.10-tuxcare.1	6.3.10-tuxcare.2
`org.springframework.integration:spring-integration-file` TuxCare:Maven From an advisory covering 14 CVEs	6.3.10 up to 6.3.10-tuxcare.2, plus listed versions 6.3.10-tuxcare.1	6.3.10-tuxcare.2
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven From an advisory covering 14 CVEs	6.3.10 up to 6.3.10-tuxcare.2, plus listed versions 6.3.10-tuxcare.1	6.3.10-tuxcare.2
`org.springframework.integration:spring-integration-http` TuxCare:Maven From an advisory covering 14 CVEs	6.3.10 up to 6.3.10-tuxcare.2, plus listed versions 6.3.10-tuxcare.1	6.3.10-tuxcare.2
`org.springframework.integration:spring-integration-ip` TuxCare:Maven From an advisory covering 14 CVEs	6.3.10 up to 6.3.10-tuxcare.2, plus listed versions 6.3.10-tuxcare.1	6.3.10-tuxcare.2
`org.springframework.integration:spring-integration-jms` TuxCare:Maven From an advisory covering 14 CVEs	6.3.10 up to 6.3.10-tuxcare.2, plus listed versions 6.3.10-tuxcare.1	6.3.10-tuxcare.2
`org.springframework.integration:spring-integration-scripting` TuxCare:Maven From an advisory covering 14 CVEs	6.3.10 up to 6.3.10-tuxcare.2, plus listed versions 6.3.10-tuxcare.1	6.3.10-tuxcare.2
`org.springframework.integration:spring-integration-smb` TuxCare:Maven From an advisory covering 14 CVEs	6.3.10 up to 6.3.10-tuxcare.2, plus listed versions 6.3.10-tuxcare.1	6.3.10-tuxcare.2
`org.springframework.integration:spring-integration-syslog` TuxCare:Maven From an advisory covering 14 CVEs	6.3.10 up to 6.3.10-tuxcare.2, plus listed versions 6.3.10-tuxcare.1	6.3.10-tuxcare.2
`org.springframework.integration:spring-integration-zip` TuxCare:Maven From an advisory covering 14 CVEs	6.3.10 up to 6.3.10-tuxcare.2, plus listed versions 6.3.10-tuxcare.1	6.3.10-tuxcare.2
`org.springframework.integration:spring-integration-core` TuxCare:Maven From an advisory covering 5 CVEs	5.3.2.RELEASE up to 5.3.2.RELEASE-tuxcare.1	5.3.2.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-file` TuxCare:Maven From an advisory covering 5 CVEs	5.3.2.RELEASE up to 5.3.2.RELEASE-tuxcare.1	5.3.2.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven From an advisory covering 5 CVEs	5.3.2.RELEASE up to 5.3.2.RELEASE-tuxcare.1	5.3.2.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-http` TuxCare:Maven From an advisory covering 5 CVEs	5.3.2.RELEASE up to 5.3.2.RELEASE-tuxcare.1	5.3.2.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-jms` TuxCare:Maven From an advisory covering 5 CVEs	5.3.2.RELEASE up to 5.3.2.RELEASE-tuxcare.1	5.3.2.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-core` TuxCare:Maven From an advisory covering 14 CVEs	6.2.5 up to 6.2.5-tuxcare.1	6.2.5-tuxcare.1
`org.springframework.integration:spring-integration-file` TuxCare:Maven From an advisory covering 14 CVEs	6.2.5 up to 6.2.5-tuxcare.1	6.2.5-tuxcare.1
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven From an advisory covering 14 CVEs	6.2.5 up to 6.2.5-tuxcare.1	6.2.5-tuxcare.1
`org.springframework.integration:spring-integration-http` TuxCare:Maven From an advisory covering 14 CVEs	6.2.5 up to 6.2.5-tuxcare.1	6.2.5-tuxcare.1
`org.springframework.integration:spring-integration-ip` TuxCare:Maven From an advisory covering 14 CVEs	6.2.5 up to 6.2.5-tuxcare.1	6.2.5-tuxcare.1
`org.springframework.integration:spring-integration-jms` TuxCare:Maven From an advisory covering 14 CVEs	6.2.5 up to 6.2.5-tuxcare.1	6.2.5-tuxcare.1
`org.springframework.integration:spring-integration-scripting` TuxCare:Maven From an advisory covering 14 CVEs	6.2.5 up to 6.2.5-tuxcare.1	6.2.5-tuxcare.1
`org.springframework.integration:spring-integration-smb` TuxCare:Maven From an advisory covering 14 CVEs	6.2.5 up to 6.2.5-tuxcare.1	6.2.5-tuxcare.1
`org.springframework.integration:spring-integration-syslog` TuxCare:Maven From an advisory covering 14 CVEs	6.2.5 up to 6.2.5-tuxcare.1	6.2.5-tuxcare.1
`org.springframework.integration:spring-integration-zip` TuxCare:Maven From an advisory covering 14 CVEs	6.2.5 up to 6.2.5-tuxcare.1	6.2.5-tuxcare.1
`org.springframework.integration:spring-integration-core` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.1	6.1.5-tuxcare.1
`org.springframework.integration:spring-integration-file` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.1	6.1.5-tuxcare.1
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.1	6.1.5-tuxcare.1
`org.springframework.integration:spring-integration-http` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.1	6.1.5-tuxcare.1
`org.springframework.integration:spring-integration-ip` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.1	6.1.5-tuxcare.1
`org.springframework.integration:spring-integration-jms` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.1	6.1.5-tuxcare.1
`org.springframework.integration:spring-integration-scripting` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.1	6.1.5-tuxcare.1
`org.springframework.integration:spring-integration-smb` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.1	6.1.5-tuxcare.1
`org.springframework.integration:spring-integration-syslog` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.1	6.1.5-tuxcare.1
`org.springframework.integration:spring-integration-zip` TuxCare:Maven From an advisory covering 14 CVEs	6.1.5 up to 6.1.5-tuxcare.1	6.1.5-tuxcare.1
`org.springframework.integration:spring-integration-core` TuxCare:Maven From an advisory covering 10 CVEs	5.1.13.RELEASE up to 5.1.13.RELEASE-tuxcare.1	5.1.13.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-file` TuxCare:Maven From an advisory covering 10 CVEs	5.1.13.RELEASE up to 5.1.13.RELEASE-tuxcare.1	5.1.13.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven From an advisory covering 10 CVEs	5.1.13.RELEASE up to 5.1.13.RELEASE-tuxcare.1	5.1.13.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-http` TuxCare:Maven From an advisory covering 10 CVEs	5.1.13.RELEASE up to 5.1.13.RELEASE-tuxcare.1	5.1.13.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-ip` TuxCare:Maven From an advisory covering 10 CVEs	5.1.13.RELEASE up to 5.1.13.RELEASE-tuxcare.1	5.1.13.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-jms` TuxCare:Maven From an advisory covering 10 CVEs	5.1.13.RELEASE up to 5.1.13.RELEASE-tuxcare.1	5.1.13.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-scripting` TuxCare:Maven From an advisory covering 10 CVEs	5.1.13.RELEASE up to 5.1.13.RELEASE-tuxcare.1	5.1.13.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-syslog` TuxCare:Maven From an advisory covering 10 CVEs	5.1.13.RELEASE up to 5.1.13.RELEASE-tuxcare.1	5.1.13.RELEASE-tuxcare.1
`org.springframework.integration:spring-integration-core` TuxCare:Maven From an advisory covering 10 CVEs	5.5.12 up to 5.5.12-tuxcare.1	5.5.12-tuxcare.1
`org.springframework.integration:spring-integration-file` TuxCare:Maven From an advisory covering 10 CVEs	5.5.12 up to 5.5.12-tuxcare.1	5.5.12-tuxcare.1
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven From an advisory covering 10 CVEs	5.5.12 up to 5.5.12-tuxcare.1	5.5.12-tuxcare.1
`org.springframework.integration:spring-integration-http` TuxCare:Maven From an advisory covering 10 CVEs	5.5.12 up to 5.5.12-tuxcare.1	5.5.12-tuxcare.1
`org.springframework.integration:spring-integration-ip` TuxCare:Maven From an advisory covering 10 CVEs	5.5.12 up to 5.5.12-tuxcare.1	5.5.12-tuxcare.1
`org.springframework.integration:spring-integration-jms` TuxCare:Maven From an advisory covering 10 CVEs	5.5.12 up to 5.5.12-tuxcare.1	5.5.12-tuxcare.1
`org.springframework.integration:spring-integration-scripting` TuxCare:Maven From an advisory covering 10 CVEs	5.5.12 up to 5.5.12-tuxcare.1	5.5.12-tuxcare.1
`org.springframework.integration:spring-integration-syslog` TuxCare:Maven From an advisory covering 10 CVEs	5.5.12 up to 5.5.12-tuxcare.1	5.5.12-tuxcare.1
`org.springframework.integration:spring-integration-core` TuxCare:Maven From an advisory covering 10 CVEs	5.4.6 up to 5.4.6-tuxcare.1	5.4.6-tuxcare.1
`org.springframework.integration:spring-integration-file` TuxCare:Maven From an advisory covering 10 CVEs	5.4.6 up to 5.4.6-tuxcare.1	5.4.6-tuxcare.1
`org.springframework.integration:spring-integration-ftp` TuxCare:Maven From an advisory covering 10 CVEs	5.4.6 up to 5.4.6-tuxcare.1	5.4.6-tuxcare.1
`org.springframework.integration:spring-integration-http` TuxCare:Maven From an advisory covering 10 CVEs	5.4.6 up to 5.4.6-tuxcare.1	5.4.6-tuxcare.1
`org.springframework.integration:spring-integration-ip` TuxCare:Maven From an advisory covering 10 CVEs	5.4.6 up to 5.4.6-tuxcare.1	5.4.6-tuxcare.1
`org.springframework.integration:spring-integration-jms` TuxCare:Maven From an advisory covering 10 CVEs	5.4.6 up to 5.4.6-tuxcare.1	5.4.6-tuxcare.1
`org.springframework.integration:spring-integration-scripting` TuxCare:Maven From an advisory covering 10 CVEs	5.4.6 up to 5.4.6-tuxcare.1	5.4.6-tuxcare.1
`org.springframework.integration:spring-integration-syslog` TuxCare:Maven From an advisory covering 10 CVEs	5.4.6 up to 5.4.6-tuxcare.1	5.4.6-tuxcare.1
`org.springframework.integration:spring-integration-file` Maven	7.0.0 up to 7.0.5, plus listed versions 7.0.17.0.27.0.37.0.4	7.0.5
`org.springframework.integration:spring-integration-file` Maven	6.5.0 up to 6.5.9, plus listed versions 6.5.16.5.26.5.36.5.46.5.56.5.66.5.76.5.8	6.5.9
`org.springframework.integration:spring-integration-file` Maven	6.4.0 to 6.4.11, plus listed versions 6.4.16.4.106.4.26.4.36.4.4 Show 5 moreShow less 6.4.56.4.66.4.76.4.86.4.9	None known
`org.springframework.integration:spring-integration-file` Maven	6.3.0 to 6.3.14, plus listed versions 6.3.16.3.106.3.116.3.26.3.3 Show 6 moreShow less 6.3.46.3.56.3.66.3.76.3.86.3.9	None known
`org.springframework.integration:spring-integration-file` Maven	through 5.5.20, plus listed versions 1.0.1.RELEASE1.0.2.RELEASE1.0.2.SR11.0.3.RELEASE1.0.4.RELEASE Show 45 moreShow less 2.0.0.RELEASE2.0.1.RELEASE2.0.3.RELEASE2.0.4.RELEASE2.0.5.RELEASE2.0.6.RELEASE2.1.0.RELEASE2.1.1.RELEASE2.1.2.RELEASE2.1.3.RELEASE2.1.4.RELEASE2.1.5.RELEASE2.1.6.RELEASE2.2.0.RELEASE2.2.1.RELEASE2.2.2.RELEASE2.2.3.RELEASE2.2.4.RELEASE2.2.5.RELEASE2.2.6.RELEASE2.2.7.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.0.5.RELEASE4.0.6.RELEASE4.0.7.RELEASE4.0.8.RELEASE4.0.9.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE	None known
`org.springframework.integration:spring-integration-file` Root:Maven	before 7.0.4-aikido.1	7.0.4-aikido.16.5.8-aikido.16.3.4-aikido.1
`io.root.org.springframework.integration:spring-integration-file` Root:Maven	before 7.0.4-root.io.1	7.0.4-root.io.16.5.8-root.io.16.3.4-root.io.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	daehyuh/CVE-2026-40987	2026-05-11

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	affected, affected_more	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40987 is a high vulnerability (CVSS 7.1) in Spring Integration, published June 11, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in org.springframework.integration:spring-integration-file 7.0.5.

References

This page doesn't list everything

Left out here: 128 versions. The JSON record has them.