{"action":"Upgrade org.springframework.integration:spring-integration-file to 6.5.9 (6.x) or 7.0.5 (7.x) or later.","affected":[{"fixed":"7.0.5","introduced":"7.0.0"},{"fixed":"6.5.9","introduced":"6.5.0"},{"introduced":"6.4.0","last_affected":"6.4.11"},{"introduced":"6.3.0","last_affected":"6.3.14"},{"introduced":"0","last_affected":"5.5.20"}],"component":"org.springframework.integration:spring-integration-file","cve_ids":["CVE-2026-40987"],"ecosystem":"Maven","epss":0.00218,"exploited":false,"fixed_versions":["7.0.5","6.5.9"],"ghsa_id":"GHSA-792x-6vq6-j8r9","id":"tcs_01M5N8HYDCQFBNKKJ29GQ22RMM","modified_at":"2026-08-07T19:15:32.748592248Z","published_at":"2026-06-11T09:31:55Z","references":["https://osv.dev/vulnerability/GHSA-792x-6vq6-j8r9","https://nvd.nist.gov/vuln/detail/CVE-2026-40987","https://github.com/spring-projects/spring-integration","https://spring.io/security/cve-2026-40987"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-792x-6vq6-j8r9","url":"https://osv.dev/vulnerability/GHSA-792x-6vq6-j8r9"}],"summary":"Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem"}