VDB

GHSA-6r3c-xf4w-jxjm

GHSA-6r3c-xf4w-jxjm PUBLISHED CVSS 6.5 MEDIUM

Spring Framework vulnerable to a reflected file download (RFD)

Record from GitHub Advisory Database · Published June 13, 2025

spring-web is fixed in 6.2.8, 6.1.21 and 6.0.23 (Maven Central)

Spring Framework vulnerable to a reflected file download (RFD)

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
org.springframework:spring-webMaven Central6.2.8, 6.1.21, 6.0.23
thingsboardChainguard4.0.1-r7
jenkins-2.479Wolfi2.479.3-r5
jenkins-2Wolfi2.515-r0
thingsboardWolfi4.0.1-r7
apache-nifi-registryChainguard2.4.0-r3
jenkins-2.504Chainguard2.504.2-r3
apache-nifi-registryWolfi2.4.0-r3
jenkins-2.479Chainguard2.479.3-r5
jenkins-2.492Chainguard2.492.3-r3
jenkins-2Chainguard2.515-r0
apache-nifiChainguard2.4.0-r5

1 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Affected products

VendorProductVersions
chainguardthingsboard0
wolfijenkins-2.4790
wolfijenkins-20
wolfithingsboard0
chainguardapache-nifi-registry0
Mavenorg.springframework:spring-web6.2.0, 6.0.5, 6.1.0
chainguardjenkins-2.5040
wolfiapache-nifi-registry0
chainguardjenkins-2.4790
chainguardjenkins-2.4920
chainguardjenkins-20
chainguardapache-nifi0
wolfiapache-nifi0

Timeline

  • Jun 13, 2025 CVE Published
  • Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-6r3c-xf4w-jxjm
vulnetix vdb fixes GHSA-6r3c-xf4w-jxjm

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-6r3c-xf4w-jxjm/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›