CVE-2017-12882: Spring Batch Admin vulnerable to Stored Cross-site scripting (XSS) in the file upload functionality

May 17, 2022 (updated September 23, 2025)

Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality.

References

github.com/advisories/GHSA-49mj-77q5-qw5g
github.com/spring-attic/spring-batch-admin
nvd.nist.gov/vuln/detail/CVE-2017-12882

Code Behaviors & Features

Detect and mitigate CVE-2017-12882 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →