CVE-2026-40987 is a path traversal vulnerability in Spring Integration’s remote file synchronization components, affecting versions across the 5.5, 6.3, 6.4, 6.5, and 7.0 release lines. Any application using Spring Integration to synchronize files from a remote FTP, SFTP, or SMB server is at risk: if that server is malicious or becomes compromised, an attacker can write arbitrary files anywhere on the client host, including web shells, backdoors, or overwritten configuration files. The business risk is unauthorized system access, potential full host compromise, and persistent attacker presence on internal infrastructure.