High
Security advisory
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-22118
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:11 UTC · Revision 1
Source evidence
In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
osv:CVE-2021-22118
Complete source record
{
"id": "ffd22ccb58b00bc31bf841fdf52889dc756590e1c03db210f581f36369553696",
"url": "https://osv.dev/vulnerability/CVE-2021-22118",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-22118",
"summary": "In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.",
"evidence": "osv:CVE-2021-22118",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-22118",
"aliases": [
"CVE-2021-22118",
"GHSA-gfwj-fwqj-fp3v"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/spring-projects/spring-framework",
"type": "GIT",
"events": [
{
"introduced": "927b8c15ef20eaaa4002d4b2170cc536a6d6aa35"
},
{
"fixed": "5d46ae91f02313ce755eb3e1c9164ee6b1468da8"
},
{
"introduced": "5acffaa72da10ba42fe547eeea44d8615cbf99b9"
},
{
"fixed": "b1280ffeaaa3d666606fbe92f34219303fa5bbd7"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.15"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.3.0"
},
{
"fixed": "5.3.7"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22118.json"
}
}
],
"modified": "2026-10-24T10:30:25.536329014Z",
"provider": "osv",
"references": [
"https://security.netapp.com/advisory/ntap-20210713-0005/",
"https://tanzu.vmware.com/security/cve-2021-22118",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://www.oracle.com/security-alerts/cpujul2022.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_diameter_intelligence_hub",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.1.0"
},
{
"introduced": "8.2.0"
},
{
"last_affected": "8.2.3"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_element_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_element_manager",
"extracted_events": [
{
"range": [
{
"introduced": "8.2.0"
},
{
"last_affected": "8.2.4.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_session_report_manager",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.2.4.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_session_route_manager",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.2.4.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:documaker:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:documaker",
"extracted_events": [
{
"range": [
{
"introduced": "12.6.0"
},
{
"last_affected": "12.6.4"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:financial_services_analytical_applications_infrastructure",
"extracted_events": [
{
"range": [
{
"introduced": "8.0.8"
},
{
"last_affected": "8.1.1"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:insurance_policy_administration",
"extracted_events": [
{
"range": [
{
"introduced": "11.0"
},
{
"last_affected": "11.3.1"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:mysql_enterprise_monitor",
"extracted_events": [
{
"range": [
{
"last_affected": "8.0.25"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_customer_management_and_segmentation_foundation",
"extracted_events": [
{
"range": [
{
"introduced": "16.0"
},
{
"last_affected": "19.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:commerce_guided_search:11.3.2:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:commerce_guided_search",
"extracted_events": [
{
"range": [
{
"introduced": "11.3.2"
},
{
"last_affected": "11.3.2"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:12.0.0.3:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_brm_-_elastic_charging_engine",
"extracted_events": [
{
"range": [
{
"introduced": "12.0.0.3"
},
{
"last_affected": "12.0.0.3"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.9.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_binding_support_function",
"extracted_events": [
{
"range": [
{
"introduced": "1.9.0"
},
{
"last_affected": "1.9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_policy",
"extracted_events": [
{
"range": [
{
"introduced": "1.14.0"
},
{
"last_affected": "1.14.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.6.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_security_edge_protection_proxy",
"extracted_events": [
{
"range": [
{
"introduced": "1.6.0"
},
{
"last_affected": "1.6.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_service_communication_proxy",
"extracted_events": [
{
"range": [
{
"introduced": "1.14.0"
},
{
"last_affected": "1.14.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_cloud_native_core_unified_data_repository",
"extracted_events": [
{
"range": [
{
"introduced": "1.14.0"
},
{
"last_affected": "1.14.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_interactive_session_recorder:6.4:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_interactive_session_recorder",
"extracted_events": [
{
"range": [
{
"introduced": "6.4"
},
{
"last_affected": "6.4"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_network_integrity",
"extracted_events": [
{
"range": [
{
"introduced": "7.3.6"
},
{
"last_affected": "7.3.6"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_unified_inventory_management",
"extracted_events": [
{
"range": [
{
"introduced": "7.4.1"
},
{
"last_affected": "7.4.1"
},
{
"introduced": "7.4.2"
},
{
"last_affected": "7.4.2"
},
{
"introduced": "7.5.0"
},
{
"last_affected": "7.5.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:enterprise_data_quality",
"extracted_events": [
{
"range": [
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
},
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:healthcare_data_repository",
"extracted_events": [
{
"range": [
{
"introduced": "8.1.0"
},
{
"last_affected": "8.1.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:insurance_rules_palette:11.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:insurance_rules_palette:11.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:insurance_rules_palette:11.2.7:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:insurance_rules_palette:11.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:insurance_rules_palette:11.3.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:insurance_rules_palette",
"extracted_events": [
{
"range": [
{
"introduced": "11.0.2"
},
{
"last_affected": "11.0.2"
},
{
"introduced": "11.1.0"
},
{
"last_affected": "11.1.0"
},
{
"introduced": "11.2.7"
},
{
"last_affected": "11.2.7"
},
{
"introduced": "11.3.0"
},
{
"last_affected": "11.3.0"
},
{
"introduced": "11.3.1"
},
{
"last_affected": "11.3.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_assortment_planning:16.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_assortment_planning",
"extracted_events": [
{
"range": [
{
"introduced": "16.0"
},
{
"last_affected": "16.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_financial_integration:14.1.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_financial_integration:15.0.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_financial_integration:16.0.3:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_financial_integration",
"extracted_events": [
{
"range": [
{
"introduced": "14.1.3.2"
},
{
"last_affected": "14.1.3.2"
},
{
"introduced": "15.0.3.1"
},
{
"last_affected": "15.0.3.1"
},
{
"introduced": "16.0.3"
},
{
"last_affected": "16.0.3"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_integration_bus:14.1.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_integration_bus:15.0.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_integration_bus:16.0.3:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_integration_bus",
"extracted_events": [
{
"range": [
{
"introduced": "14.1.3.2"
},
{
"last_affected": "14.1.3.2"
},
{
"introduced": "15.0.3.1"
},
{
"last_affected": "15.0.3.1"
},
{
"introduced": "16.0.3"
},
{
"last_affected": "16.0.3"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_merchandising_system:19.0.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_merchandising_system",
"extracted_events": [
{
"range": [
{
"introduced": "19.0.1"
},
{
"last_affected": "19.0.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_order_broker:16.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_order_broker",
"extracted_events": [
{
"range": [
{
"introduced": "16.0"
},
{
"last_affected": "16.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_predictive_application_server:14.1.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_predictive_application_server",
"extracted_events": [
{
"range": [
{
"introduced": "14.1.3"
},
{
"last_affected": "14.1.3"
},
{
"introduced": "15.0.3"
},
{
"last_affected": "15.0.3"
},
{
"introduced": "16.0.3"
},
{
"last_affected": "16.0.3"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:utilities_testing_accelerator",
"extracted_events": [
{
"range": [
{
"introduced": "6.0.0.1.1"
},
{
"last_affected": "6.0.0.1.1"
},
{
"introduced": "6.0.0.2.2"
},
{
"last_affected": "6.0.0.2.2"
},
{
"introduced": "6.0.0.3.1"
},
{
"last_affected": "6.0.0.3.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-22118",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 431389,
"published_at": "2021-05-27T15:15:07.437+00:00"
}