{
  "@id": "urn:uuid:f477c5c0-b351-43a9-9776-964aa4f7e7b9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-02T14:58:56.128088+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.integration/spring-integration-file@6.0.9-tuxcare.2",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.integration/spring-integration-file@6.0.9-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-27T08:32:54.402906+00:00",
      "status_notes": "Vulnerability CVE-2026-40987 does not affect version 6.0.9-tuxcare.2 of org.springframework.integration:spring-integration-file. Spring Integration 6.0.9 contains the upstream fix for CVE-2026-40987 (path traversal in FTP/SFTP/SMB file downloads). The defense method FileUtils.newFileInDirectoryIfValid() validates all file paths before creation, rejecting absolute paths and directory traversal sequences. This fix was present in the upstream Spring Integration 6.0.9 release",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40987"
      },
      "impact_statement": "Spring Integration 6.0.9 contains the upstream fix for CVE-2026-40987 (path traversal in FTP/SFTP/SMB file downloads). The defense method FileUtils.newFileInDirectoryIfValid() validates all file paths before creation, rejecting absolute paths and directory traversal sequences. This fix was present in the upstream Spring Integration 6.0.9 release"
    }
  ]
}