CVE-2026-22739 Path Traversal via Profile Parameter

CVE-2026-22739 is a high-severity vulnerability. AttackerView checks Spring Boot sites for it with a live exploit check.

Is my site vulnerable to CVE-2026-22739?

Detects Spring Cloud Config Servers vulnerable to directory traversal via the profile URL segment. The environment and resource endpoints validate the name and label parameters for path traversal but skip the profile parameter. An attacker injects encoded dot-dot sequences to escape the configured search directory and read arbitrary configuration files, database credentials, and API keys from the server filesystem.