StackRadar

CVE-2024-38816

High

Advisory

Published 13 Sept 2024In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.147
96th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
162
of 17,781 indexed, latest versions
Container images
157
deployed by those charts
Fix available
2 of 2
affected packages

Path traversal vulnerability in functional web frameworks

Carried by container images the latest versions of 162 of 17,781 indexed charts deploy, on 157 images.

Affected packageAffected versionsFixed inImages
spring-webmvcmaven5.3.1, 5.3.2, 5.3.3, 5.3.4+39 more6.1.13138
spring-webfluxmaven5.3.1, 5.3.7, 5.3.8, 5.3.10+17 more6.1.1343
OSV records
GHSA-cx7f-g6mp-7hqm

Charts affected

162 by stars
ChartLatestAffected imagesRadar Score
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2024-38816.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
spring-webmvc@5.3.27
no fix listed

Open the chart page →

18,756
thingsboardthingsboardVerified publisher0.1.34 of 12See more

thingsboard thingsboard 0.1.3

4 of the 12 container images this version deploys carry CVE-2024-38816.

Container imageDigestPackageFixed in
thingsboard/tb-coap-transport:3.4.1bd45a09d85d9
spring-webmvc@5.3.20
no fix listed
thingsboard/tb-http-transport:3.4.1a06f53c5e2da
spring-webmvc@5.3.20
no fix listed
thingsboard/tb-mqtt-transport:3.4.1030f316ce301
spring-webmvc@5.3.20
no fix listed
thingsboard/tb-node:3.4.1645f43b688f7
spring-webmvc@5.3.20
no fix listed

Open the chart page →

25,394
togglr-backendtogglrVerified publisher1.0.01 of 1See more

togglr-backend togglr 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-38816.

Container imageDigestPackageFixed in
gdrocha/togglr-backend:1.0.0d5ae64e83d4c
spring-webmvc@6.0.13
no fix listed

Open the chart page →

3,221
configservertwomartensVerified publisher0.2.01 of 1See more

configserver twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2024-38816.

Container imageDigestPackageFixed in
2martens/configserver:latestbf1cdb80239d
spring-webmvc@6.1.12
6.1.13

Open the chart page →

2,144
kube-monitoring-telegram-botviento-repository1.0.01 of 1See more

kube-monitoring-telegram-bot viento-repository 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-38816.

Container imageDigestPackageFixed in
vientoprojects/kubernetes-monitoring-telegram-bot:latesteb2a71531741
spring-webmvc@5.3.9
no fix listed

Open the chart page →

7,885
webapp-db-javawebapp-db-java-repo0.1.01 of 2See more

webapp-db-java webapp-db-java-repo 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-38816.

Container imageDigestPackageFixed in
arturisimo/webapp-db-java:v2c95524e90b57
spring-webmvc@5.3.15
no fix listed

Open the chart page →

2,566
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-38816.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
spring-webflux@5.3.15
no fix listed

Open the chart page →

14,364
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2024-38816.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
spring-webflux@5.3.15
no fix listed

Open the chart page →

28,605
hazelcastwenerme5.10.21 of 2See more

hazelcast wenerme 5.10.2

1 of the 2 container images this version deploys carry CVE-2024-38816.

Container imageDigestPackageFixed in
hazelcast/management-center:5.5.2991ddb27c251
spring-webmvc@6.1.12
6.1.13

Open the chart page →

2,634
workshop-pipelinesworkshop-pipelines0.1.61 of 2See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2024-38816.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
spring-webmvc@6.1.1
6.1.13

Open the chart page →

11,577
zahori-processzahoriVerified publisher1.0.11 of 1See more

zahori-process zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2024-38816.

Container imageDigestPackageFixed in
zahoriaut/zahori-process:0.1.13351f8a220ed7
spring-webmvc@6.0.10
no fix listed

Open the chart page →

3,480
zahori-serverzahoriVerified publisher1.0.11 of 2See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2024-38816.

Container imageDigestPackageFixed in
zahoriaut/zahori-server:0.1.17b2de13916f3e
spring-webflux@5.3.25
spring-webmvc@5.3.25
no fix listed
no fix listed

Open the chart page →

5,846

Container images carrying it

157 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
spring-webmvc@6.1.1
6.1.13
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
spring-webflux@6.0.11
spring-webmvc@6.0.14
no fix listed
no fix listed
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
spring-webmvc@6.1.3
6.1.13
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
spring-webmvc@6.1.3
6.1.13
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
spring-webmvc@6.1.3
6.1.13
1
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
spring-webmvc@5.3.31
no fix listed
1
quay.io/srcmaxim/gradle-example-app:1.1.37c3fc28746ef
spring-webmvc@5.3.7
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.