{"id":"CVE-2020-5405","aliases":["EUVD-2020-0490","GHSA-g86w-v5vg-9gxf"],"status":"published","title":"Directory Traversal with spring-cloud-config-server","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.68542,"percentile":0.99343,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22","CWE-23"],"published":"2020-03-05T19:00:19Z","modified":"2026-10-24T10:31:01Z","exploits":[{"source":"nuclei","id":"CVE-2020-5405","title":"Spring Cloud Config - Local File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5405.yaml"},{"source":"pocgithub","id":"shoucheng3/spring-cloud__spring-cloud-config_CVE-2020-5405_2-1-6-RELEASE","title":"shoucheng3/spring-cloud__spring-cloud-config_CVE-2020-5405_2-1-6-RELEASE","date":"2025-08-20","url":"https://github.com/shoucheng3/spring-cloud__spring-cloud-config_CVE-2020-5405_2-1-6-RELEASE"}],"fixes":[{"ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","fixed_in":["2.1.7","2.2.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.7"}]}],"versions":["2.1.0.RELEASE","2.1.1.RELEASE","2.1.2.RELEASE","2.1.3.RELEASE","2.1.4.RELEASE","2.1.5.RELEASE","2.1.6.RELEASE"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-config-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.2"}]}],"versions":["2.2.0.RELEASE","2.2.1.RELEASE"]}],"products":[{"vendor":"spring","product":"spring cloud config"},{"vendor":"spring by vmware","product":"spring cloud config"},{"vendor":"vmware","product":"spring_cloud_config"}],"references":[{"url":"https://pivotal.io/security/cve-2020-5405","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5405","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g86w-v5vg-9gxf"},{"url":"https://github.com/spring-cloud/spring-cloud-config/spring-cloud-config-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-5405","title":"Directory Traversal with spring-cloud-config-server","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","status":"published","published":"2020-03-05T19:00:19.429Z","modified":"2024-09-16T22:36:28.048Z","cwes":["CWE-23"],"updated_at":"2026-11-02T14:35:47.22408Z"}],"euvd":[{"id":"EUVD-2020-0490","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","status":"published","published":"2020-03-05T19:00:19Z","modified":"2024-09-16T22:36:28Z","updated_at":"2026-11-03T00:55:01.59966Z"}],"ghsa":[{"id":"GHSA-g86w-v5vg-9gxf","title":"Directory traversal attack in Spring Cloud Config","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","status":"published","published":"2020-06-05T16:11:36Z","modified":"2023-02-01T05:02:59Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22","CWE-23"],"updated_at":"2026-11-02T14:36:31.364752Z"}],"nvd":[{"id":"CVE-2020-5405","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","status":"published","published":"2020-03-05T19:15:11.7Z","modified":"2026-06-17T03:21:25.987Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-23","CWE-22"],"updated_at":"2026-11-02T14:05:54.796125Z"}],"osv":[{"id":"CVE-2020-5405","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","status":"published","published":"2020-03-05T19:15:11.7Z","modified":"2026-10-24T10:31:01.182604586Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"GHSA-g86w-v5vg-9gxf","title":"Directory traversal attack in Spring Cloud Config","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","status":"published","published":"2020-06-05T16:11:36Z","modified":"2023-11-08T04:03:55.163505Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22","CWE-23"],"updated_at":"2026-11-02T15:46:47.472172Z"}]}}