StackRadar

CVE-2026-47884

Critical

Advisory

Published 27 Aug 2026In the index since 6 Oct 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
367
of 18,026 indexed, latest versions
Container images
328
deployed by those charts
Fix available
1 of 1
affected package

Spring Framework Improper Path Limitation in XsltView

Carried by container images the latest versions of 367 of 18,026 indexed charts deploy, on 328 images.

Affected packageAffected versionsFixed inImages
spring-webmvcmaven2.5.6, 2.5.6.SEC03, 3.2.18.RELEASE, 4.3.1.RELEASE+99 more7.0.9328
OSV records
GHSA-pc63-qcmh-9cmg

Charts affected

367 by stars
ChartLatestAffected imagesRadar Score
mod-password-validatorfolio-org0.1.341 of 1See more

mod-password-validator folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
folioci/mod-password-validator:latestb31d75f2bf7b
spring-webmvc@7.0.8
7.0.9

Open the chart page →

395
mod-remote-storagefolio-org0.1.321 of 1See more

mod-remote-storage folio-org 0.1.32

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
folioci/mod-remote-storage:latest4f12177123dc
spring-webmvc@7.0.8
7.0.9

Open the chart page →

572
mod-serials-managementfolio-org0.1.11 of 1See more

mod-serials-management folio-org 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
folioci/mod-serials-management:latest571fa1ffe8c9
spring-webmvc@5.3.39
no fix listed

Open the chart page →

1,735
mod-service-interactionfolio-org0.1.61 of 1See more

mod-service-interaction folio-org 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
folioci/mod-service-interaction:latestf53c327a48e8
spring-webmvc@5.3.39
no fix listed

Open the chart page →

1,735
mod-tagsfolio-org0.1.341 of 1See more

mod-tags folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
folioci/mod-tags:latest6e8beeb70272
spring-webmvc@7.0.8
7.0.9

Open the chart page →

343
frinx-machinefrinx-helm-charts11.0.01 of 26See more

frinx-machine frinx-helm-charts 11.0.0

1 of the 26 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
frinx/conductor-server:6.1.159aa36c359f2
spring-webmvc@5.3.30
no fix listed

Open the chart page →

49,865
workflow-managerfrinx-helm-charts3.2.11 of 5See more

workflow-manager frinx-helm-charts 3.2.1

1 of the 5 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
frinx/conductor-server:6.1.0d01264a908c9
spring-webmvc@5.3.22
no fix listed

Open the chart page →

9,835
pagesgary-pages1.0.01 of 3See more

pages gary-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
airsonicgeek-cookbookVerified publisher6.4.21 of 1See more

airsonic geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
spring-webmvc@5.3.8
no fix listed

Open the chart page →

18,970
booksonic-airgeek-cookbookVerified publisher6.4.21 of 1See more

booksonic-air geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/booksonic-air:version-v2009.1.0baa4fa9549dc
spring-webmvc@5.2.6.RELEASE
no fix listed

Open the chart page →

19,960
gapsgeek-cookbookVerified publisher5.4.21 of 1See more

gaps geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
housewrecker/gaps:latestf417dd0a7547
spring-webmvc@5.3.18
no fix listed

Open the chart page →

9,338
komgageek-cookbookVerified publisher2.4.21 of 1See more

komga geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
gotson/komga:0.99.49b15ea6bfc30
spring-webmvc@5.3.7
no fix listed

Open the chart page →

12,963
nzbhydra2geek-cookbookVerified publisher10.4.21 of 1See more

nzbhydra2 geek-cookbook 10.4.2

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

19,223
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
spring-webmvc@3.2.18.RELEASE
no fix listed

Open the chart page →

29,226
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.82 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

2 of the 5 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
spring-webmvc@5.2.12.RELEASE
no fix listed
jingking/geonetwork-hnap:4.2.843e74ab234e1
spring-webmvc@5.3.30
no fix listed

Open the chart page →

37,657
video-analytics-demogpu-operator0.1.91 of 3See more

video-analytics-demo gpu-operator 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
anguda/ant-media:2.5c435285fc241
spring-webmvc@5.3.20
no fix listed

Open the chart page →

16,363
siembolgresearch0.1.62 of 4See more

siembol gresearch 0.1.6

2 of the 4 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
gresearchdev/siembol-config-editor-rest:latest91863a50afb7
spring-webmvc@5.3.23
no fix listed
gresearchdev/siembol-storm-topology-manager:latest8dad36a05ebf
spring-webmvc@5.3.23
no fix listed

Open the chart page →

16,153
cc-spring-appgridgainVerified publisher1.0.61 of 1See more

cc-spring-app gridgain 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
gridgain/cloud-connector:2025.5.15ab838d7d3cb
spring-webmvc@6.2.15
no fix listed

Open the chart page →

1,917
hapi-fhirhapi-fhirVerified publisher0.1.01 of 1See more

hapi-fhir hapi-fhir 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
polyakov/hapi-fhir-jpaserver-example:latestdbcef69146b8
spring-webmvc@4.3.1.RELEASE
no fix listed

Open the chart page →

7,368
nacosheidaodageshiwoVerified publisher0.1.51 of 1See more

nacos heidaodageshiwo 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
nacos/nacos-server:v2.1.0dcf04549c6d7
spring-webmvc@5.1.18.RELEASE
no fix listed

Open the chart page →

4,104
hello-world-apihello-world-api0.0.51 of 1See more

hello-world-api hello-world-api 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
fabioformosa/hello-world-api:latest063873af085c
spring-webmvc@6.2.5
no fix listed

Open the chart page →

1,538
helm-airportshelm-airports0.1.03 of 7See more

helm-airports helm-airports 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dina1993/airports-api:latestac731244aed1
spring-webmvc@6.0.7
no fix listed
dina1993/airports-consumer:latest669d146a5e63
spring-webmvc@6.0.7
no fix listed
dina1993/airports-producer:latest3d6b0dac1cb4
spring-webmvc@6.0.7
no fix listed

Open the chart page →

15,030
pageshelm-chart-repos-camden1.0.01 of 3See more

pages helm-chart-repos-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
springboothelmcharts1.0.01 of 1See more

springboot helmcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
kimb88/hello-world-spring-boot:latest0639155241cb
spring-webmvc@5.0.8.RELEASE
no fix listed

Open the chart page →

6,506
chart-bookhelm-deploy-book0.1.01 of 3See more

chart-book helm-deploy-book 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dannielkil/book-backend:lateste3b479a55a69
spring-webmvc@5.3.22
no fix listed

Open the chart page →

10,494
jasperreportshelm-dojo8.0.0-v1.31 of 2See more

jasperreports helm-dojo 8.0.0-v1.3

1 of the 2 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
palopalepalo/jasperreports:8-v1.356b99b194d20
spring-webmvc@5.2.21.RELEASE
no fix listed

Open the chart page →

7,622
alfiohelmforgeVerified publisher1.2.121 of 3See more

alfio helmforge 1.2.12

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
alfio/alf.io:2.0-M5-26060c836a081446
spring-webmvc@6.2.18
no fix listed

Open the chart page →

2,292
booklorehelmforgeVerified publisher2.0.21 of 3See more

booklore helmforge 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
ghcr.io/booklore-app/booklore:v2.3.1d3d3af34bc2c
spring-webmvc@7.0.8
7.0.9

Open the chart page →

2,382
komgahelmforgeVerified publisher1.4.161 of 1See more

komga helmforge 1.4.16

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
gotson/komga:1.27.19cf102f5fb78
spring-webmvc@6.2.19
no fix listed

Open the chart page →

35,970
openaevhelm-openbasVerified publisher2.0.101 of 7See more

openaev helm-openbas 2.0.10

1 of the 7 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
openaev/platform:3.261001.0c00eabc46ae7
spring-webmvc@6.2.19
no fix listed

Open the chart page →

7,553
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
openbas/platform:2.0.5d986d80b0a75
spring-webmvc@6.1.16
no fix listed

Open the chart page →

25,785
pageshelm-repo1.0.01 of 3See more

pages helm-repo 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-webmvc@5.2.7.RELEASE
no fix listed

Open the chart page →

21,150
todo-apihelm-repo-sharif0.1.01 of 2See more

todo-api helm-repo-sharif 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
pavanelthepu/todo-api:1.0.2f47658e3b24c
spring-webmvc@5.3.8
no fix listed

Open the chart page →

2,638
sys-info-web-env-view-serverhuajuan-helm-charts0.1.11 of 2See more

sys-info-web-env-view-server huajuan-helm-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
huajuan6848/env-view-server:0.0.1-SNAPSHOTa303f3d9f6e0
spring-webmvc@6.0.11
no fix listed

Open the chart page →

2,080
ibm-microclimateibm-charts0.1.02 of 8See more

ibm-microclimate ibm-charts 0.1.0

2 of the 8 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
spring-webmvc@4.3.9.RELEASE
no fix listed
ibmcom/microclimate-theia:lateste17bdccc5030
spring-webmvc@4.3.9.RELEASE
no fix listed

Open the chart page →

119,072
nifi-registryimprowisedVerified publisher1.0.01 of 2See more

nifi-registry improwised 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
apache/nifi-registry:1.27.063b8e3e40742
spring-webmvc@5.3.37
no fix listed

Open the chart page →

5,888
fpga-operatorinaccelVerified publisher2.8.21 of 7See more

fpga-operator inaccel 2.8.2

1 of the 7 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
inaccel/coral:2.18c53744ed70b
spring-webmvc@5.3.31
no fix listed

Open the chart page →

7,192
appswitcher-serverit-at-mOfficialVerified publisher2.0.21 of 1See more

appswitcher-server it-at-m 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/appswitcher-server:1.3.010006bc0f309
spring-webmvc@6.2.6
no fix listed

Open the chart page →

4,503
daveit-at-mOfficialVerified publisher0.2.184 of 9See more

dave it-at-m 0.2.18

4 of the 9 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/dave-backend/dave-backend:10.0.0f66413e62afc
spring-webmvc@6.2.19
no fix listed
ghcr.io/it-at-m/dave-document-storage/dave-document-storage:10.0.09c7fc07330c9
spring-webmvc@6.2.19
no fix listed
ghcr.io/it-at-m/dave-eai/dave-eai:10.0.0fd93e0d125b3
spring-webmvc@6.2.19
no fix listed
ghcr.io/it-at-m/dave-geodata-eai/dave-geodata-eai:10.0.06a3fe3136856
spring-webmvc@6.2.19
no fix listed

Open the chart page →

14,812
kf-app-eaiit-at-mOfficialVerified publisher0.1.71 of 1See more

kf-app-eai it-at-m 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/kf-app-eai:1.0.65de339b3d537
spring-webmvc@6.2.10
no fix listed

Open the chart page →

2,236
zammad-ldap-syncit-at-mVerified publisher0.6.51 of 1See more

zammad-ldap-sync it-at-m 0.6.5

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/zammad-ldap-sync:dev10de22c8cbce
spring-webmvc@6.2.1
no fix listed

Open the chart page →

1,568
jenkinsjenkins-x0.10.381 of 2See more

jenkins jenkins-x 0.10.38

1 of the 2 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
jenkinsci/jenkins:2.67a1f33f004659
spring-webmvc@2.5.6.SEC03
no fix listed

Open the chart page →

12,235
proxerajfwenischVerified publisher0.12.201 of 1See more

proxera jfwenisch 0.12.20

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
ghcr.io/wenisch-tech/proxera:0.12.205ac0e9f6b42f
spring-webmvc@7.0.8
7.0.9

Open the chart page →

325
steamcmd-managerjfwenischVerified publisher0.4.51 of 1See more

steamcmd-manager jfwenisch 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/steamcmd-manager:v0.4.5dab685e668d9
spring-webmvc@6.2.0
no fix listed

Open the chart page →

7,486
webtoolsjfwenischVerified publisher0.1.41 of 1See more

webtools jfwenisch 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/webtools:v0.1.44569cae83c70
spring-webmvc@6.2.0
no fix listed

Open the chart page →

7,467
spring-boot-chartjhidalgo3-githubVerified publisher4.0.01 of 1See more

spring-boot-chart jhidalgo3-github 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
jhidalgo3/spring-echo-example:lateste08733191ea0
spring-webmvc@5.3.3
no fix listed

Open the chart page →

1,816
xxl-job-adminjoelee2012Verified publisher1.1.01 of 2See more

xxl-job-admin joelee2012 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
xuxueli/xxl-job-admin:2.4.0640093c35fd6
spring-webmvc@5.3.25
no fix listed

Open the chart page →

3,575
k8sforjavak8sforjava0.1.01 of 1See more

k8sforjava k8sforjava 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
vincentgwzhang/k8sforjava:latesta9139f2cd98f
spring-webmvc@6.2.1
no fix listed

Open the chart page →

1,617
unifik8sonlabVerified publisher0.3.71 of 1See more

unifi k8sonlab 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
jacobalberty/unifi:v10.0.162896c0ab82d33
spring-webmvc@6.1.21
no fix listed

Open the chart page →

8,235
kanbanapp-demokanbanapp-demo0.3.01 of 3See more

kanbanapp-demo kanbanapp-demo 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-47884.

Container imageDigestPackageFixed in
sdandey/dandey-apps:kanban-board-kanban-appbef0f599737b
spring-webmvc@5.1.8.RELEASE
no fix listed

Open the chart page →

7,553

Container images carrying it

328 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/it-at-m/kf-app-eai:1.0.65de339b3d537
spring-webmvc@6.2.10
no fix listed
1
ghcr.io/it-at-m/zammad-ldap-sync:dev10de22c8cbce
spring-webmvc@6.2.1
no fix listed
1
ghcr.io/itobey/fddb-exporter:2.4.1a824933e0f87
spring-webmvc@7.0.8
7.0.9
1
ghcr.io/jfwenisch/ipfix-generator:latesta1b05567dbf6
spring-webmvc@6.2.18
no fix listed
1
ghcr.io/jfwenisch/steamcmd-manager:v0.4.5dab685e668d9
spring-webmvc@6.2.0
no fix listed
1
ghcr.io/jfwenisch/webtools:v0.1.44569cae83c70
spring-webmvc@6.2.0
no fix listed
1
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
spring-webmvc@5.2.7.RELEASE
no fix listed
1
ghcr.io/linuxserver/booksonic:version-1.2677efca1065d
spring-webmvc@2.5.6
no fix listed
1
ghcr.io/linuxserver/booksonic-air:version-v2009.1.0baa4fa9549dc
spring-webmvc@5.2.6.RELEASE
no fix listed
1
ghcr.io/linuxserver/davos:2.2.1-ls7624ba55aeaa4f
spring-webmvc@4.3.4.RELEASE
no fix listed
1
ghcr.io/perceptolab/devops-demo-app:0.0.2cdc0658c40fb
spring-webmvc@5.3.23
no fix listed
1
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
spring-webmvc@5.3.31
no fix listed
1
ghcr.io/stacksimplify/kube-usermgmt-webapp:1.0.0-mysqldb41b45003c6b6
spring-webmvc@5.1.8.RELEASE
no fix listed
1
ghcr.io/star-whale/server:0.6.158368359c8dd0
spring-webmvc@5.3.24
no fix listed
1
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
spring-webmvc@7.0.7
7.0.9
1
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
spring-webmvc@6.2.18
no fix listed
1
ghcr.io/thm-mni-ii/fbs-core:v2.0.617b65f8b5119
spring-webmvc@5.3.27
no fix listed
1
ghcr.io/thm-mni-ii/fbs-identity-service:v2.0.699b9f84726fa
spring-webmvc@6.2.18
no fix listed
1
ghcr.io/wenisch-tech/proxera:0.12.205ac0e9f6b42f
spring-webmvc@7.0.8
7.0.9
1
public.ecr.aws/aws-containers/retail-store-sample-cart:1.3.05d767569c976
spring-webmvc@6.2.10
no fix listed
1
public.ecr.aws/aws-containers/retail-store-sample-orders:1.3.0e85f034bcf48
spring-webmvc@6.2.10
no fix listed
1
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
spring-webmvc@6.1.1
no fix listed
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
spring-webmvc@6.0.14
no fix listed
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
spring-webmvc@6.1.3
no fix listed
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
spring-webmvc@6.1.3
no fix listed
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
spring-webmvc@6.1.3
no fix listed
1
quay.io/snowdrop/spring-boot-rest-http-example:2.7b1a054613715
spring-webmvc@5.3.31
no fix listed
1
quay.io/srcmaxim/gradle-example-app:1.1.37c3fc28746ef
spring-webmvc@5.3.7
no fix listed
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.