CVE-2026-59280

Affected versions of the `org.springframework:spring-webmvc` package are vulnerable to Path Traversal due to improper confinement of view names resolved through `SpringTemplateLoader`. The `SpringTemplateLoader` resolves view names reaching the FreeMarker integration without restricting them to the configured template root, allowing a controller to derive its view name from request input. An attacker can exploit this by supplying traversal sequences in the request input, causing the application to render templates from outside the intended directory.