### [CVE-2016-9878](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9878)
![](https://img.shields.io/static/v1?label=Product&message=Pivotal%20Spring%20Framework%20before%203.2.18%2C%204.2.x%20before%204.2.9%2C%20and%204.3.x%20before%204.3.5&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Directory%20Traversal&color=brighgreen)

### Description

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

### POC

#### Reference
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/SusiSusi/cybersecuritybase-project
- https://github.com/ilmari666/cybsec